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Using This Manual 



This manual will show you how to use the HP 64797 H8/3048 
Emulator with the Softkey Interface. This manual will also help define 
how these emulators differ from other HP 64700 Emulators. 

This manual will: 

■ Show you how to use emulation commands by executing them 
on a sample program and describing their results. 

■ Show you how to configure the emulator for your 
development needs. Topics include: restricting the emulator 
to real-time execution, and selecting a target system clock 
source. 

■ Show you how to use the emulator in-circuit (connected to a 
target system). 

This manual will not: 

■ Show you how to use every Softkey Interface command and 
option; the Softkey Interface is described in the Softkey 
Interface Reference 



Organization 

Chapter 1 



Introduction. This chapter lists the H8/3048 emulator features and 
describes how they can help you in developing new hardware and 
software. 



Chapter 2 

Chapter 3 
Chapter 4 

Chapter 5 
Chapter 6 



Getting Started. This chapter shows you how to use emulation 
commands by executing them on a sample program. This chapter 
describes the sample program and how to: load programs into the 
emulator, map memory, display and modify memory, display registers, 
step through programs, run programs, set software breakpoints, search 
memory for data, and use the analyzer. 

In-Circuit Emulation. This chapter shows you how to plug the 
emulator into a target system, and how to use the "in-circuit" emulation 
features. 



Configuring the Emulator. You can configure the emulator to adapt 
it to your specific development needs. This chapter describes the 
options available when configuring the emulator and how to save and 
restore particular configurations. 

Using the Emulator. This chapter describes emulation topics which 
are not covered in the "Getting Started" chapter. 

Using On-chip Flash Memory. This chapter describes differences 
between flash memory functions of the H8/3048 emulator and actual 
on-chip flash memory. 



Conventions 



Example commands throughout the manual use the following 
conventions: 



bold 

bold italic 

normal 
$ 

<RETURN> 



Commands, options, and parts of command syntax. 

Commands, options, and parts of command syntax 
which may be entered by pressing softkeys. 

User specified parts of a command. 

Represents the HP-UX prompt. Commands which 
foUow the "$" are entered at the HP-UX prompt. 



The carriage return key. 
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Introduction 

The topics in this chapter include: 

■ Purpose of the H8/3048 Emulator 

■ Features of the H8/3048 Emulator 



Purpose of the 
H8/3048 Emulator 



The H8/3048 Emulator is designed to replace the H8/3048 
microprocessor in your target system so you can control operation of 
the microprocessor in your application hardware (usually referred to as 
the target system). The H8/3048 emulator performs just like the 
H8/3048 microprocessor, but is a device that allows you to control the 
H8/3048 microprocessor directly. These features allow you to easily 
debug software before any hardware is available, and ease the task of 
integrating hardware and software. 
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Figure 1-1 . HP 64797 Emulator for the H8/3048 
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Features of the 
H8/3048 Emulator 



SU pported The HP 64797A H8/3048 emulator supports the microprocessors listed 
Microprocessors in Table 1-1. 

Table 1-1. Supported Microprocessors 



Supported Microprocessors 


Type 


Package 


On-chip ROM 


Supply Voltage 


H8/3048 


100 pin QFP 


PROM 


4.75 to 5.25V 
2.70 to 5.25V 


Masked ROM 


4.75 to 5.25V 
2.70 to 5.25V 


H8/3048F 


100 pin QFP 


Flash Memory 


4.25 to 5.25V 
2.70 to 5.25V 


H8/3047 


100 pin QFP 


Masked ROM 


4.75 to 5.25V 
2.70 to 5.25V 


H8/3044 


100 pin QFP 


Masked ROM 


4.75 to 5.25V 
2.70 to 5.25V 



The H8/3048 emulator is provided without any adaptor and probe. To 
emulate each processor with your target system, you need to purchase 
appropriate adaptor and probe. To purchase them, contact your local 
HP sales representative. 

The list of supported microprocessors in Table 1-1 is not necessarily 
complete. To determine if your microprocessor is supported or not, 
contact Hewlett-Packard. 
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ClOCk Speeds You can select whether the emulator will be clocked by the internal 

clock source or by the external clock source on your target system. You 
need to select a clock input conforming to the specification of Table 
1-2. 

Crystal ocsillator frequency of internal clock is 8MHz. 

Refer to the "Configuration the Emulator" Chapter in this manual for 
more details. 



Table 1-2. Clock Speeds 



Emulation 
Memory 


Clock Speed 


With HP64784D 


With HP64784E 


With HP64797B 


64726A 
64727A 
64728A 


From 1 up to 16MHz 
(System Clock) 


From 1 up to 16MHz 
(System Clock) 


From 1 up to 13MHz 
(System Clock) 


64729A 


From 1 up to 18MHz 
(System Clock) 


From 1 up to 18MHz 
(System Clock) 


From 1 up to 13MHz 
(System Clock) 
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Emulation memory 



Analysis 



Registers 



The H8/3048 emulator is used with one of the following Emulation 
Memory Cards. 

■ HP 64726A 128K byte Emulation Memory Card 

■ HP 64727 A 5 1 2K byte Emulation Memory Card 

■ HP 64728 A 1M byte Emulation Memory Card 

■ HP 64729A 2M byte Emulation Memory Card 

When you use the HP64797A emulator over 16MHz, you have to use 
the HP 64729A 2M byte Emulation Memory Card. 

You can define up to 16 memory ranges (at 512 byte boundaries and 
least 512 byte in length.) The emulator occupies 6K byte, which is 
used for monitor program and internal RAM of microprocessor mapped 
as emulation RAM, leaving 122K, 506K, 1018K, 2042K byte of 
emulation memory which you may use. 

You can characterize memory range as emulation RAM (eram), 
emulation ROM (erom), target system RAM (tram), target system 
ROM (trom), or guarded memory (grd). The emulator generates an 
error message when accesses are made to guarded memory locations. 

You can also configure the emulator so that writes to memory defined 
as ROM cause emulator execution to break out of target program 
execution. 



The H8/3048 emulator is used with one of the following analyzers 
which allows you to trace code execution and processor activity. 

■ HP 64704A 80-channel Emulation Bus Analyzer 

■ HP 64703A 64-channel Emulation Bus Analyzer and 
16-channel State/Timing Analyzer. 

■ HP 64794A/C/D Deep Emulation Bus Analyzer 

The Emulation Bus Analyzer monitors the emulation processor using 
an internal analysis bus. The HP 64703 A 64-channel Emulation Bus 
Analyzer and 16-channel State/Timing Analyzer allows you to probe 
up to 16 different lines in your target system. 

You can display or modify the H8/3048 internal register contents. This 
includes the ability to modify the program counter (PC) value so you 
can control where the emulator starts a program run. 
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Breakpoints You can set the emulator/analyzer interaction so the emulator will 

break to the monitor program when the analyzer finds a specific state or 
states, allowing you to perform post-mortem analysis of the program 
execution. You can also set software breakpoints in your program. 
This feature is realized by inserting a special instruction into user 
program. One of undefined opcodes (5770 hex) is used as software 
breakpoint instruction. Refer to the "Using Software Breakpoints" 
section of "Getting Started" chapter for more information. 



Reset Support The emulator can be reset from the emulation system under your 
control; or your target system can reset the emulation processor. 

Real Time Operation Real-time signifies continuous execution of your program at full rated 

processor speed without interference from the emulator. (Such 
interference occurs when the emulator needs to break to the monitor to 
perform an action you requested, such as displaying target system 
memory.) Emulator features performed in real time include: running 
and analyzer tracing. Emulator features not performed in real time 
include: display or modification of target system memory, load/dump 
of target memory, display or modification of registers. 



Easy Product 
Updates 



Because the HP 64700 Series development tools(emulator, analyzer, 
LAN board) contain programmable parts, it is possible to reprogram 
the firmware and some of the hardware without disassembling the HP 
64700B Card Cage. This means that you'll be able to update product 
firmware, if desired, without having to call to HP field representative to 
your site. 
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Limitations, 
Restrictions 

Foreground Monitor Foreground monitor is not supported for the H8/3048 emulator. 



DMA Support Direct memory access to the emulation by external DMAC is not 
allowed. 

Watch Dog Timer in Watch dog timer is suspended count up while the emulator is running 
Backg rOU nd in background monitor. 



Monitor Break at 
Sleep/Standby Mode 



When the emulator breaks into the background monitor, sleep or 
software standby mode is released. Then, PC indicates next address of 
"SLEEP" instruction. 



Hardware Standby 
Mode 



Hardware standby mode is not supported for the H8/3048 emulator. 
Hardware standby request from target system will drive the emulator 
into the reset state. 



Interrupts in 
Background Cycles 



The H8/3048 emulator does not accept any interrupts while in 
background monitor. Such interrupts are suspended while running the 
background monitor, and will occur when context is changed to 
foreground. 



On-chip Flash 
Memory 



The H8/3048 emulator uses emulation memory instead of actual 
on-chip flash memory. So, operation for on-chip flash memory is 
different from H8/3048 microprocessor. Refer to "Using the On-chip 
Flash Memory" chapter in this manual for more details. 



Evaluation chip 



Hewlett-Packard makes no warranty of the problem caused by the 
H8/3048 Evaluation chip in the emulator. 
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Getting Started 

Introduction This chapter will lead you through a basic, step by step tutorial 

designed to familiarize you with the use of the H8/3048 emulator with 
the Softkey Interface. 

This chapter will: 

■ Tell you what must be done before you can use the emulator 
as shown in the tutorial examples. 

■ Describe the sample program used for this chapter's example. 

This chapter will show you how to: 

■ Start up the Softkey Interface. 

■ Load programs into emulation and target system memory. 

■ Enter emulation commands to view execution of the sample 
program. 
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Before You Begin 



Prerequisites Before beginning the tutorial presented in this chapter, you must have 
completed the following tasks: 

1. Connected the emulator to your computer. The HP 64700 
Series Installation/Service manual show you how to do this. 

2. Installed the Softkey Interface software on your computer. 
Refer to the HP 64700 Series Installation/Service manual for 
instructions on installing software. 

3. In addition, you should read and understand the concepts of 
emulation presented in the Concepts of Emulation and 
Analysis manual. The Installation/Service manual also covers 
HP64700 system architecture. A brief understanding of these 
concepts may help avoid questions later. 

You should read the Softkey Interface Reference manual to 
learn how to use the Softkey Interface in general. For the 
most part, this manual contains information specific to the 
H8/3048 emulator. 

The sample program used in this chapter is listed in figure 2-1 . The 
program emulates a primitive command interpreter. The sample 
program is shipped with the Softkey Interface and may be copied from 
the following location. 

/usr/hp64000/demo/emul/hp64797/cmd_rds.src 



Data Declarations 

The "Table" section defines the messages used by the program to 
respond to various command inputs. These messages are labeled 
Msg_A,Msg_B, and Msg_I. 



A Look at the Sample 
Program 
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. GLOBAL 
. GLOBAL 



Init , Msgs , Cmd_Input 
Msg_Dest 



Msgs 

Msg_A 

Msg_B 

Msg_I 

End_Msgs 



. SECTION 

. SDATA 
. SDATA 
. SDATA 



Table, DATA 

"THIS IS MESSAGE A" 
"THIS IS MESSAGE B" 
"INVALID COMMAND" 



. SECTION 



Prog, CODE 

.**************************************************** 
;* Set up the Stack Pointer. 

.**************************************************** 

Init MOV.L #Stack,ER7 

.**************************************************** 

; * Clear previous command. 

.**************************************************** 
Clear MOV.B #H'00,R0L 

MOV.B ROL, @Cmd_Input 

* Read command input byte. If no command has been 

* entered, continue to scan for it. 

**************************************************** 



Scan 



MOV.B 
CMP .B 



@Cmd_Input, R2L 
#H' 00, R2L 



BEQ Scan 
**************************************************** 

* A command has been entered. Check if it is 

* command A, command B, or invalid command. 
**************************************************** 



Exe_Cmd 



********** 



CMP.B #H'41,R2L 
BEQ Cmd_A 
CMP.B #H'42,R2L 
BEQ Cmd_B 
BRA Cmd_I 
************************************** 



* Command A is entered. R3L = the number of bytes 

* in message A. R4 = location of the message. 

* Jump to the routine which writes the message. 



t********** 



t************* 



Cmd_A 



MOV.B 
MOV. L 

BRA 



#Msg_B-Msg_A, R3L 
#Msg_A, ER4 
Write_Msg 



Command B is entered. 



************ 



t ***** * 



t ***** * 



Cmd_B MOV . B 

MOV. L 

BRA 

.**************************************************** 
; * An invalid command is entered. 

.**************************************************** 



#Msg_I-Msg_B, R3L 
#Msg_B, ER4 
Write_Msg 



Cmd_I 



MOV.B 
MOV. L 

******* 



#End_Msgs-Msg_I, R3L 
#Msg_I, ER4 
t********************* 



Figure 2-1 . Sample Program Listing 
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;* The destination area is cleared. 

Write_Msg MOV.L #Msg_Dest , ER5 

Clear_01d MOV.B #H'20,R6L 

Clear_Loop MOV.B ROL, @ER5 

ADDS . L #1,ER5 

DEC . B R6L 

BNE Clear_Loop 

; * Message is written to the destination. 

MOV.L #Msg_Dest, ER5 

Write_Loop MOV.B @ER4+,R6L 

MOV.B R6L,@ER5 

ADDS . L #1,ER5 

DEC . B R3L 

BNE Write_Loop 

i 

; * Go back and scan for next command. 

T 

BRA Clear 

. SECTION Data, DATA 

T 

}* Command input byte. 

Cmd_Input .RES.B 1 

.RES.B 1 

t 

;* Destination of the command messages. 

Msg_Dest .RES.W H' 80 
Stack 

. END Init 



Figure 2-1. Sample Program Listing (Cont'd) 
Initialization 

The program instruction at the Init label initializes the stack pointer. 
Reading Input 

The instruction at the Clear label clears any random data or previous 
commands from the Cmdjnput byte. The Scan loop continually 
reads the Cmdjnput byte to see if a command is entered (a value 
other than 0 hex). 
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Processing Commands 

When a command is entered, the instructions from Exe_Cmd to 
Cmd_A determine whether the command was "A", "B", or an invalid 
command. 

If the command input byte is "A" (ASCII 41 hex), execution is 
transferred to the instructions at Cmd_A. 

If the command input byte is "B" (ASCII 42 hex), execution is 
transferred to the instructions at Cmd_B. 

If the command input byte is neither "A" nor "B", an invalid command 
has been entered, and execution is transferred to the instructions at 
Cmd_I. 

The instructions at Cmd_A, Cmd_B, and Cmd_I each load register 
R3L with the length of the message to be displayed and register ER4 
with the starting location of the appropriate message. Then, execution 
transfers to Write_Msg which writes the appropriate message to the 
destination location, Msg_Dest. 

Prior to writing the message, Clear_01d clears the destination area. 
After the message is written, the program branches back to read the 
next command. 

The Destination Area 

The "Data" section declares memory storage for the command input 
byte, the destination area, and the stack area. 
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Sample Program 
Assembly 



The sample program is written for and assembled with the Hitachi 
Cross System. The sample program was assembled with the following 
command. 

$ asm38 cmd_rds.src -debug -cpu=300ha 

<RETURN> 



Linking the Sample 
Program 



The sample program can be linked with following command and 
generates the absolute file. The contents of "cmd_rds.k" linkage editor 
subcommand file is shown in figure 2-2. 

$ Ink -subcommand=cmd_rds . k <RETURN> 



debug 

input cmd_rds 

start Prog (1000) , Table (2000) . 
output cmd_rds 
print cmd_rds 
exit 



Data (0FF800) 



Figure 2-2. Linkage Editor Subcommand File 



Generate HP 
Absolute file 



To generate HP Absolute file for the Softkey Interface, you need to use 
"h83cnvhp" absolute file format converter program. The h83cnvhp 
converter is provided with HP 64797 Softkey Interface. To generate 
HP Absolute file, enter following command: 

$ h83cnvhp cmd_rds <RETURN> 

You will see that cmd_rds.X, cmd_rds.L, and cmd_rds.A are generated. 
These are sufficient throughout this chapter. 



Note 
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You need to specify "debug" command line option for compiler, 
assembler and linker command to generate local symbol information. 
Otherwise, you will see the warning message when file format 
converter h83cnvhp is executed. And no local symbol file will be 
generated. The "debug" option directs to include local symbol 
information to the object file. 



2-6 Getting Started 



Entering the If you have installed your emulator and Softkey Interface software as 

Soft ke V I nte rf aCG directed in the HP 64700 Series Emulators Softkey Interface 

* Installation Notice, you are ready to enter the interface. The Softkey 

Interface can be entered from the HP-UX shell. 



From the HP-UX Shell If /usr/hp64000/bin is specified in your PATH environment variable, 

you can also enter the Softkey Interface with the following command. 

S emul700 <emul_name> <RETURN> 



The "emul_name" in the command above is the logical emulator name 
given in the HP 64700 emulator device table 
(/usr/hp64000/etc/64700tab or /usr/hp64000/etc/64700tab.net). 



# + + + 

# Channel I Logical | Processor | Remainder of Information for the Channel 

# Type I Name I Type I (IP address for LAN connections) 

# + + + 

lan: h8300 h6473048 21.17.9.143 



If this command is successful, you will see a display similar to figure 
2-3. The status message shows that the default configuration file has 
been loaded. If the command is not successful, you will be given an 
error message and returned to the HP-UX prompt. Error messages are 
described in the Softkey Interface Reference manual. 
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HPB3077-11002 A. 05. 20 15Jun94 Unreleased 
H8/3048 SOFTKEY USER INTERFACE 

A Hewlett-Packard Software Product 
Copyright Hewlett-Packard Co. 1993 

All Rights Reserved. Reproduction, adaptation, or translation without prior 
written permission is prohibited, except as allowed under copyright laws. 

RESTRICTED RIGHTS LEGEND 

Use , duplication , or disclosure by the Government is subject to 
restrictions as set forth in subparagraph (c) (1) (II) of the Rights 
in Technical Data and Computer Software clause at DFARS 52.227-7013. 
HEWLETT-PACKARD Company , 3000 Hanover St. , Palo Alto, CA94304-1181 



STATUS: Starting new session 



step display 



modify break 



end 



-ETC- 



Using the Default 
Configuration 



Figure 2-3. Softkey Interface Display 

The default emulator configuration is used with the sample program. 
The H8/3048 emulator is configured to emulate H8/3048 chip and the 
address range 0 hex through ffff hex is mapped as emulation ROM. 
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Note Mil When you use internal ROM/on-chip flash memory area, you must 

map that area as emulation memory. If you don't map internal ROM 
properly, you cannot access that area. 



Note 




Since the H8/3048 emulator automatically maps internal RAM as 
emulation RAM, you don't need to map this area. 



Refer to "Memory Configuration" section of "Configuring the 
Emulator" chapter in this manual for more details. 
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On-Line Help 


There are two ways to access on-line help in the Softkey Interface. The 
first is by using the Softkey Interface help facility. The second method 
allows you to access the firmware resident Terminal Interface on-line 
help information. 


Softkey Driven Help 


To access the Softkey Interface on-line help information, type either 
"help" or "?" on the command line; you will notice a new set of 
softkeys. By pressing one of these softkeys and <RETURN>, you can 
cause information on that topic to be displayed on your screen. For 
example, you can enter the following command to access "system 
command" help information. 

? system_commands <RETURN> 


SYSTEM COMMANDS S COMMAND FILES 


9 

help 


displays the possible help files 
displays the possible help files 


i 

!<shell command> 


fork a shell (specified by shell variable SH) 
fork a shell and execute a shell command 


pwd 

cd <directory> 


print the working directory 
change the working directory 


pws 

cws <SYMB> 


print the default symbol scope 

change the working symbol - the working symbol also 
gets updated when displaying local symbols and 
displaying memory mnemonic 


forward <UI> "command" 


send the command in the quoted string from this user 
interface to another one. Replace <UI> with the name 
the other user interface as shown on the softkeys : 


--More-- (15%) 




The help information is scrolled on to the screen. If there is more than 
a screenful of information, you will have to press the space bar to see 
the next screenful, or the <RETURN> key to see the next line, just as 
you do with the HP-UX more command. After all the information on 
the particular topic has been displayed (or after you press "q" to quit 
scrolling through information), you are prompted to press <RETURN> 
to return to the Softkey Interface. 
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Pod Command Help To access the emulator's firmware resident Terminal Interface help 

information, you can use the following commands. 

display pod_command <RETURN> 

pod_command 'help m' <RETURN> 

The command enclosed in string delimiters (", ', or A ) is any Terminal 
Interface command, and the output of that command is seen in the 
pod_command display. The Terminal Interface help (or ?) command 
may be used to provide information on any Terminal Interface 
command or any of the emulator configuration options (as the example 
command above shows). 



Pod Commands 

Time Command 

m <addr> - display memory at address 

m -d<dtype> <addr> - display memory at address with display option 

m <addr> . . <addr> - display memory in specified address range 

m -dm <addr> . . <addr> - display memory mnemonics in specified range 

m <addr> . . - display 128 byte block starting at address A 

m <addr>=<value> - modify memory at address to <value> 

m -d<dtype> <addr>=<value> - modify memory with display option 

m <addr>=<value>, <value> - modify memory to data sequence 

m <addr> . . <addr>=<value>, <value> - fill range with repeating sequence 

VALID <dtype> MODE OPTIONS 

b - display size is 1 byte(s) 
w - display size is 2 byte(s) 
1 - display size is 4 byte(s) 
m - display processor mnemonics 

STATUS: H8/3042 — Running in monitor ...R. 

pod_command 'help m' 



pod_cmd set perfinit perfrun perfend ETC- 
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Loading Absolute The "load" command allows you to load absolute files into emulation 
p j |gg or target system memory. If you wish to load only that portion of the 

absolute file that resides in memory mapped as emulation RAM or 
ROM, use the "load emul_mem" syntax. If you wish to load only the 
portion of the absolute file that resides in memory mapped as target 
RAM, use the "load user_mem" syntax. If you want both emulation 
and target memory to be loaded, do not specify "emul_mem" nor 
"user_mem". For example: 

load cmd_rds <RETURN> 

Normally, you will configure the emulator and map memory before 
you load the absolute file; however, the default configuration is 
sufficient for the sample program. 



Displaying 
Symbols 



When you load an absolute file into memory (unless you use the 
"nosymbols" option), symbol information is loaded. Both global 
symbols and symbols that are local to a source file can be displayed. 



G lobal To display global symbols, enter the following command. 

display global_symbols <RETURN> 

Listed are: address ranges associated with a symbol. 
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Global symbols in cmd_rds 
Static symbols 

Symbol name Address 


range Segment 




Offset 


Cmd_Input 0FF800 
Init 001000 
Msg_Dest 0FF802 
Msgs 002000 






0000 
0000 
0002 
0000 


Filename symbols 
Filename 








cmd_rds . src 








STATUS: H8/3048-Running in monitor 






... R ... . 


display global_symbols 








run trace step display 


modify break 


end 


ETC — 



Local When displaying local symbols, you must include the name of the 
source file in which the symbols are defined. For example, 

display local_symbols_in cmd_rds . src : 
<RETURN> 



Symbols in cmd_ 


rds . src : 










Static symbols 












Symbol name 




Address 


range Segment 




Offset 


Clear 




001006 






0006 


Clear_Loop 




001050 






0050 


Clear_01d 




00104E 






004E 


Cmd_A 




001028 






0028 


Cmd_B 




001034 






0034 


Cmd_I 




001040 






0040 


Cmd_Input 




0FF800 






0000 


Data 




0FF800 






0000 


END_Msgs 




00002031 








Exe_Cmd 




001018 






0018 


Init 




001000 






0000 


Msg_A 




002000 






0000 


Msg_B 




002011 






0011 


Msg_Dest 




0FF802 






0002 


Msg_I 




002022 






0022 


STATUS: cws : cmd rds.src 








... R ... . 


display local_ 


symbols_in 


cmd_rds . src : 








run trace 


step 


display 


modify break 


end 


ETC — 



2-12 Getting Started 



Displaying 
Memory in 
Mnemonic Format 



You can display, in mnemonic format, the absolute code in memory. 
For example, to display the memory of the "cmd_rds" program, 



display memory Init mnemonic <RETURN> 

Notice that you can use symbols when specifying expressions. The 
global symbol Init is used in the command above to specify the starting 
address of the memory to be displayed. 



Memory : mnemonic :file = 


cmd_rds . src : 


address 


data 






001000 


7A07000FF9 


MOV 


L #000FF902, ER7 


001006 


F800 


MOV 


B #00,R0L 


001008 


6AA8000FF8 


MOV 


B R0L, 0OFF8OO 


00100E 


6A2A000FF8 


MOV 


B @0FF800,R2L 


001014 


AA00 


CMP 


B #00,R2L 


001016 


47F6 


BEQ 


00100E 


001018 


AA41 


CMP 


B #41,R2L 


00101A 


5870000A 


BEQ 


001028 


00101E 


AA42 


CMP 


B #42,R2L 


001020 


58700010 


BEQ 


001034 


001024 


58000018 


BRA 


001040 


001028 


FB11 


MOV 


B #11,R3L 


00102A 


7A04000020 


MOV 


L #00002000, ER4 


001030 


58000014 


BRA 


001048 


001034 


FB11 


MOV 


B #11,R3L 


001036 


7A04000020 


MOV 


L #00002011, ER4 



STATUS: H8/3048 — Running in monitor ...R.... 

display memory Init mnemonic 

run trace step display modify break end ETC — 
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Displaying 
Memory with 
Symbols 



You can include symbol information in memory display. 
set symbols on <RETURN> 



Memory :mnemonic :file 


= cmd_rds . 


src : 




address 


label 


data 






001000 


: Init 


7A07000FF9 


MOV 


L #000FF902, ER7 


001006 


cmd_rd : Clear 


F800 


MOV 


B #00,R0L 


001008 




6AA8000FF8 


MOV 


B R0L, @ : Cmd_Input 


00100E 


cmd_rds : Scan 


6A2A000FF8 


MOV 


B @ : Cmd_Input, R2L 


001014 




AA00 


CMP 


B #00,R2L 


001016 




47F6 


BEQ 


cmd_rds . src : Scan 


001018 


cmd_ : Exe_Cmd 


AA41 


CMP 


B #41,R2L 


00101A 




5870000A 


BEQ 


cmd_rds . sr : Cmd_A 


00101E 




AA4 2 


CMP 


B #42,R2L 


001020 




58700010 


BEQ 


cmd_rds . sr : Cmd_B 


001024 




58000018 


BRA 


cmd_rds . sr : Cmd_I 


001028 


cmd_rd : Cmd_A 


FB11 


MOV 


B #11,R3L 


00102A 




7A04000020 


MOV 


L #00002000, ER4 


001030 




58000014 


BRA 


cmd_rd : Write_Msg 


001034 


cmd_rd : Cmd_B 


FB11 


MOV 


B #11,R3L 


001036 




7A04000020 


MOV 


L #00002011, ER4 



STATUS: H8/3048 — Running in monitor . ..R.... 

set symbols on 

pod_cmd set perfinit perfrun perfend ETC — 



Note 




The "set" command is effective only to the window which the 
command is invoked. When you access the emulator from multiple 



windows, you need to use the command at each window. 



2-14 Getting Started 



Running the The "run" command lets the emulator execute a program in memory. 

PrOQ T3m Entering the "run" command by itself causes the emulator to begin 

executing at the current program counter address. The "run from" 
command allows you to specify an address at which execution is to 
start. 



From Transfer The "run from transfer_address" command specifies that the emulator 
AddreSS starl: executing at a previously defined "start address". Transfer 

addresses are defined in assembly language source files with the .END 
assembler directive (i.e., pseudo instruction). For example, the sample 
program defines the address of the label Init as the transfer address. 
The following command will cause the emulator to execute from the 
address of the Init label. 

run from trans f&r_address <RETURN> 



From Reset The " run from reset" command specifies that the emulator begin 

executing from target system reset (see "Running From Reset" section 
in the "In-Circuit Emulation" chapter). 



Displaying You can display memory locations repetitively so that the information 

Mpmnrv on tne screen * s constantly updated. For example, to display the 

* Msg_Dest locations of the sample program repetitively (in blocked 

Repetitively byte format), enter the following command. 

display memory Msg_Dest repetitively blocked 
bytes < RET URN > 
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The sample program simulates a primitive command interpreter. 
Commands are sent to the sample program through a byte sized 
memory location labeled Cmdjnput. You can use the modify 
memory feature to send a command to the sample program. For 
example, to enter the command "A" (41 hex), use the following 
command. 

modify memory Cmd_Input bytes to 41h <RETURN> 

Or: 

modify memory Cmd_Input string to 'A' 

<RETURN> 



Memory 


: bytes 


: access=bytes : 


Dlocked 


repetitively 






address 


data 


: hex 












: ascii 


OFFi 


S02-09 


54 


48 


49 


53 


20 


49 


53 


20 


T H 


IS IS 


OFFi 


iOA-11 


4D 


45 


53 


53 


41 


47 


45 


20 


M E 


S S AGE 


OFF! 


512-19 


41 


00 


00 


00 


00 


00 


00 


00 


A 




OFFi 


ilA-21 


00 


00 


00 


00 


00 


00 


00 


00 






OFF! 


i22-29 


00 


00 


00 


00 


00 


00 


00 


00 






OFFi 


S2A-31 


00 


00 


00 


00 


00 


00 


00 


00 






OFFi 


S32-39 


00 


00 


00 


00 


00 


00 


00 


00 






OFFi 


S3A-41 


00 


00 


00 


00 


00 


00 


00 


00 






OFFi 


i42-49 


00 


00 


00 


00 


00 


00 


00 


00 






OFFJ 


54A-51 


00 


00 


00 


00 


00 


00 


00 


00 






OFFJ 


i52-59 


00 


00 


00 


00 


00 


00 


00 


00 






OFF! 


S5A-61 


00 


00 


00 


00 


00 


00 


00 


00 






OFFi 


S62-69 


00 


00 


00 


00 


00 


00 


00 


00 






OFF! 


S6A-71 


00 


00 


00 


00 


00 


00 


00 


00 






OFF! 


i72-79 


00 


00 


00 


00 


00 


00 


00 


00 






OFFi 


57A-81 


00 


00 


00 


00 


00 


00 


00 


00 






STATUS : 


H8/304 


8 — Runninc 


user 


program 










... R ... . 


modify 


memory 


Cmd_ 


_Input 


bytes 


to 


41h 












run 


trace 




step 


display 






modify 


break 




end ETC — 



After the memory location is modified, the repetitive memory display 
shows that the "THIS IS MESSAGE A" message is written to the 
destination locations. 



Modifying Memory 
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Breaking into the 
Monitor 



The "break" command allows you to divert emulator execution from 
the user program to the monitor. You can continue user program 
execution with the "run" command. To break emulator execution from 
the sample program to the monitor, enter the following command. 

break < RET URN > 



Note 




If DMA transfer is in progress with BURST transfer mode, break 
command is suspended and occurs after DMA transfer is completed. 



Using Software 
Breakpoints 



Software breakpoints are provided with an H8/3048 special code; This 
special code (5770 hexadecimal) is H8/3048 undefined instruction. 



When you define or enable a software breakpoint, the emulator will 
replace the opcode at the software breakpoint address with the special 
code. 



4 



Note Mm You must set software breakpoints only at memory locations which 
contain instruction opcodes (not operands or data). If a software 
breakpoint is set at a memory location which is not an instruction 
opcode, the software breakpoint instruction will never be executed and 
the break will never occur. 



Note 




Because software breakpoints are implemented by replacing opcodes 
with the special code, you cannot define software breakpoints in target 



ROM. 
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When software breakpoints are enabled and emulator detects a fetching 
the special code (5770 hexadecimal), it generates a break to 
background request which as with the "processor break" command. 
Since the system controller knows the locations of defined software 
breakpoints, it can determine whether the special code is software 
breakpoints or opcode in your target program. 

If it is a software breakpoint, execution breaks to the monitor,and the 
special code is replaced by the original opcode. A subsequent run or 
step command will execute from this address. 

If the special code is opcode of your target program, execution still 
breaks to the monitor, and an "Undefined software breakpoint" status 
message is displayed. 

When software breakpoints are disabled, the emulator replaces the 
special code with the original opcode. 

Unlimited software breakpoints may be defined. 

Enabling/Disabling When you initially enter the Softkey Interface, software breakpoints are 
Software Breakpoints disabled. To enable the software breakpoints feature, enter the 

following command. 

modify software_breakpoints enable <RETURN> 

When software breakpoints are enabled and you set a software 
breakpoint, the H8/3048 special code (5770 hexadecimal) will be 
placed at the address specified. When the special code is executed, 
program execution will break into the monitor. 
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Setting a Software 
Breakpoint 



To set a software breakpoint at the address of the Cmd_A label, enter 
the following command. 



modify software_breakpoints set 

cmd_rds . src : Cmd_A <RETURN> 
Notice that when using local symbols in expressions, the source file in 
which the local symbol is defined must be included. 

After the software breakpoint has been set, enter the following 
command to display memory and see if the software breakpoint was 
correctly inserted. 

display memory Init mnemonic <RETURN> 



Memory :mnemonic : f ile = cmd_rds . src : 
address label data 



001000 




Init 


7A07000FF9 


MOV 


L #000FF902, ER7 


001006 


cmd_ 


_rd: Clear 


F800 


MOV 


B #00,R0L 


001008 






6AA8000FF8 


MOV 


B R0L, @ : Cmd_Input 


00100E 


cmd_ 


_rds : Scan 


6A2A000FF8 


MOV 


B @ : Cmd_Input , R2L 


001014 






AA00 


CMP 


B #00,R2L 


001016 






47F6 


BEQ 


cmd_rds . src : Scan 


001018 


cmd_ 


_: Exe_Cmd 


AA41 


CMP 


B #41,R2L 


00101A 






5870000A 


BEQ 


cmd_rds . sr : Cmd_A 


00101E 






AA4 2 


CMP 


B #42,R2L 


001020 






58700010 


BEQ 


cmd_rds . sr : Cmd_B 


001024 






58000018 


BRA 


cmd_rds . sr : Cmd_I 


001028 


cmd_ 


_rd: Cmd_A 


5770 


Illegal Opcode 


00102A 






7A04000020 


MOV 


L #00002000, ER4 


001030 






58000014 


BRA 


cmd_rd : Write_Msg 


001034 


cmd_ 


_rd: Cmd_B 


FB11 


MOV 


B #11,R3L 


001036 






7A04000020 


MOV 


L #00002011, ER4 



STATUS: H8/3048 — Running in monitor ...R.... 

display memory Init mnemonic 



trace step display modify break end ETC- 



As you can see, the software breakpoint is shown in the memory 
display with an asterisk. 

Enter the following command to cause the emulator to continue 
executing the sample program. 

run < RET URN > 

Now, modify the command input byte to a valid command for the 
sample program. 
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modify memory Cmd_Input bytes to 41h <RETURN> 



You will see the line of the software breakpoint is displayed in 
inverse- video. The inverse-video shows that the Program Counter is 
now at the address. 

A message on the status line shows that the software breakpoint has 
been hit. The status line also shows that the emulator is now executing 
in the monitor. 

Clearing a Software To remove software breakpoint defined above, enter the following 
Breakpoint command 

modify software_breakpoints clear 

cmd_rds . src : Cmd_A < RE TURN > 

The breakpoint is removed from the list, and the original opcode is 
restored if the breakpoint was pending. 

To clear all software breakpoints, you can enter the following 
command. 

modify software_breakpoints clear <RETURN> 



StGp P i 11 g Th rOUgh The step command allows you to step through program execution an 
th6 PfOOrSm instruction or a number of instructions at a time. Also, you can step 

** from the current program counter or from a specific address. To step 

through the example program from the address of the software 
breakpoint set earlier, enter the following command. 

Step <RETURN>, <RETURN>, . . . 

You will see the inverse-video moves according to the step execution. 
You can continue to step through the program just by pressing the 
<RETURN> key; when a command appears on the command line, it 
may be entered by pressing <RETURN>. 
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Displaying 
Registers 



Enter the following command to display registers. You can display the 
basic registers class, or an individual register. 



display registers <RETURN> 



Registers 








Next_PC 001030 

PC 001030 SP 000FF902 CCR 80 <i 
ERO 00000000 ERl 00000000 ER2 00000041 
ER4 00002000 ER5 000FF813 ER6 00000041 


> MDCR C7 
ER3 00000011 
ER7 000FF902 






STATUS: H8/3048 — Stepping complete 






... R ... . 


display registers 








run trace step display 


modify break 


end 


ETC — 



You can use "register class" and "register name" to display registers. 
Refer to the "Register Class and Name" section in Chapter 5. 

When you enter the "step" command with registers displayed, the 
register display is updated every time you enter the command. 

Step <RETURN>, <RETURN>, <RETURN> 
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Registers 














LMexr. r u 
















PC 


001030 


SP 


000FF902 CCR 80 <i 


> 


MDCR C7 






ERO 


00000000 


ER1 


00000000 ER2 00000041 


ER3 


OOOOOOI 1 






ER4 


00002000 


ER5 


000FF813 ER6 00000041 


ER7 


000FF902 






Step_PC 


001030 


BRA cmd_rd:Write_Msg 










Next_PC 


001048 














PC 


001048 


SP 


000FF902 CCR 80 <i 


> 


MDCR C7 






ERO 


00000000 


ER1 


00000000 ER2 00000041 


ER3 


00000011 






ER4 


00002000 


ER5 


000FF813 ER6 00000041 


ER7 


000FF902 






Step_PC 


001048 


VIOV. L 


#000FF802, ER5 










Next_PC 


00104E 














PC 


00104E 


SP 


000FF902 CCR 80 <i 


> 


MDCR C7 






ERO 


00000000 


ER1 


00000000 ER2 00000041 


ER3 


00000011 






ER4 


00002000 


ER5 


000FF802 ER6 00000041 


ER7 


000FF902 






STATUS : 


H8/304 


8 — Steppina complete 








... R ... . 


step 
















run 


trace 


step display 


modify break 


end 


ETC — 



Enter the following command to cause sample program execution to 
continue from the current program counter. 

run < RET URN > 



HP 64700 emulators contain an emulation analyzer. The emulation 
analyzer monitors the internal emulation lines (address, data, and 
status). Optionally, you may have an additional 16 trace signals which 
monitor external input lines. The analyzer collects data at each pulse of 
a clock signal, and saves the data (a trace state) if it meets a "storage 
qualification" condition. 



Suppose you want to trace program execution after the point at which 
the sample program reads the "B" (42 hex) command from the 
command input byte. To do this you would trace after the analyzer 
finds a state in which a value of 42xxh is read from the Cmdjnput 
byte. The following command makes this trace specification. 

trace after Cmci_Input data 4 2xxh status read 
<RETURN> 



Using the Analyzer 



Specifying a Simple 
Trigger 



2-22 Getting Started 



The message "Emulation trace started" will appear on the status line. 
Now, modify the command input byte to "B" with the following 
command. 

modify memory Cmd_Input bytes to 4 2h <RETURN> 
The status line now shows "Emulation trace complete". 

Displaying the Trace The trace listings which follow are of program execution on the 

H8/3048 emulator. To display the trace, enter: 



display trace <RETURN> 



Trace List Depth= 


512 


Of f set=0 










Label: Address 




Data Opcode or 


Status 




time 


count 


Base: symbols 




hex mnemonic w 


/ symbols 




relative 


after :Cmd_Input 




42FF 42xx read mem 


byte 






+001 


:cmd_rds:+000016 


47F6 


BEQ cmd_rds . src : Scan 




240 


nS 


+ 002 


cmd_rds . : Exe_Cmd 


AA41 


CMP.B #41,R2L 




240 


nS 


+ 003 


cmd_rds . src : Scan 


6A2A 


6A2A unused fetch mem 




240 


nS 


+ 004 


: cmd_rds : +00001A 


5870 


BEQ cmd_rds . sr : Cmd_A 




280 


nS 


+ 005 


: cmd_rds : +00001C 


OOOA 


OOOA fetch mem 




240 


nS 


+ 006 


: cmd_rds : +00001E 


AA42 


CMP.B #42,R2L 




480 


nS 


+ 007 


: cmd_rds : +000020 


5870 


BEQ cmd_rds . sr : Cmd_B 




280 


nS 


+ 008 


: cmd_rds : +000022 


0010 


0010 fetch mem 




240 


nS 


+ 009 


cmd_rds . sr : Cmd_B 


FBll 


MOV.B #11,R3L 




480 


nS 


+ 010 


:cmd_rds: +000036 


7A04 


MOV.L #00002011, ER4 




280 


nS 


+ 011 


: cmd_rds : +000038 


0000 


0000 fetch mem 




240 


nS 


+ 012 


: cmd_rds : +00003A 


2011 


2011 fetch mem 




240 


nS 


+ 013 


: cmd_rds : +00003C 


5800 


BRA cmd_rd : Write_Msg 




240 


nS 


+ 014 


: cmd_rds : +00003E 


0008 


0008 fetch mem 




280 


nS 




STATUS: H8/3048 — Running 


user program Emulation 


trace complete 




.R. . . . 


display trace 














run trace 


step 


display modify 


break 


end 




-ETC — 



Line 0 (labeled "after") in the trace list above shows the state which 
triggered the analyzer. The trigger state is always on line 0. The other 
states show the exit from the Scan loop and the Exe_Cmd and Cmd_B 
instructions. To list the next lines of the trace, press the <PGDN> or 
<NEXT> key. 
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Trace List Depth=512 


Of f set=0 








Label : 


Address 


Data Opcode 


or Status 


time 


count 


Base : 


symbols 


hex mnemonic 


w/ symbols 


relative 


+ 015 cmd_rd : Write_Msg 


7A05 MOV.L #000FF802 


, ER5 


480 


nS +016 


: cmd_rds : 


+00004A 000F 


000F fetch mem 


240 


nS 


+ 017 


: cmd_rds : 


+00004C F802 


F802 fetch mem 


280 


nS 


+ 018 


cmd_rd: Clear_01d FE20 


MOV.B #20,R6L 


240 


nS 


+ 019 


cmd_r : Clear_Loop 68D8 


MOV.B R0L, @ER5 


240 


nS 


+ 020 


: cmd_rds : 


+000052 0B05 


ADDS #1,ER5 


240 


nS 


+ 021 


:Msg_Dest 


0000 


OOxx write mem byte 


280 


nS +022 


: cmd_rds : 


+000054 1A0E 


DEC.B R6L 


240 


nS 


+ 023 


: cmd_rds : 


+000056 46F8 


BNE cmd_r : Clear_Loop 


240 


nS 


+ 024 


: cmd_rds : 


+000058 7A05 


7A05 fetch mem 


240 


nS 


+ 025 


cmd_r : Clear_Loop 68D8 


MOV.B R0L, @ER5 


280 


nS 


+ 026 


: cmd_rds : 


+000052 0B05 


ADDS #1,ER5 


240 


nS 


+ 027 


: cmd_rds : 


+000003 0000 


xxOO write mem byte 


240 


nS 


+ 028 


: cmd_rds : 


+000054 1A0E 


DEC.B R6L 


240 


nS 


+ 029 


: cmd_rds : 


+000056 46F8 


BNE cmd_r : Clear_Loop 


280 


nS 




STATUS : 


H8/3048 — Running user program Emulation trace complete 




.R. . . . 


display 


trace 










run 


trace step 


display modify break end 




--ETC — 



The resulting display shows Cmd_B instructions, the branch to 
Write_Msg and the beginning of the instructions which move the 
"THIS IS MESSAGE B" message to the destination locations. 

To list the previous lines of the trace, press the <PGUP> or <PREV> 
key. 



Displaying Trace With Enter the following command to display count information absolute 

Time Count Absolute from the trigger state 

display trace count absolute <RETURN> 
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Trace Li; 
Label : 
Base : 
after 
: cmd_rds : 
cmd_rds . : 
cmd_rds . f 
: cmd_rds : 
: cmd_rds : 
: cmd_rds : 
: cmd_rds : 
: cmd_rds : 
cmd_rds . ; 
: cmd_rds : 
: cmd_rds : 
: cmd_rds : 
: cmd_rds : 
: cmd_rds : 
STATUS : 
display 



Depth=512 
Address 
symbols 
: Cmd_Input 
300016 
e_Cmd 
: Scan 
0001A 
0001C 
IE 
00020 
00022 
Cmd_B 
00036 
00038 
0003A 
0003C 
0003E 
8/304J 
race 



Of f set= 
Data 
hex 

42FF 



Opcode or Status 
mnemonic w/symbols 
42xx read mem byte 



time count 
absolute 



47F6 


BEQ cmd_rds . src : Scan 


+ 


240 




nS 


+ 002 


AA41 


CMP.B #41,R2L 


+ 


480 




nS 


+ 003 


6A2A 


6A2A unused fetch mem 


+ 


720 




nS 


+ 004 


5870 


BEQ cmd_rds . sr : Cmd_A 


+ 


1 


00 


uS 


+ 005 


000A 


000A fetch mem 


+ 


1 


24 


uS 


+ 006 


AA42 


CMP.B #42,R2L 


+ 


1 


72 


uS 


+ 007 


5870 


BEQ cmd_rds . sr : Cmd_B 


+ 


2 


00 


uS 


+ 008 


0010 


0010 fetch mem 


+ 


2 


24 


uS 


+ 009 


FB11 


MOV.B #11,R3L 


+ 


2 


72 


uS 


+ 010 


7A04 


MOV.L #00002011, ER4 


+ 


3 


00 


uS 


+ 011 


0000 


0000 fetch mem 


+ 


3 


24 


uS 


+ 012 


2011 


2011 fetch mem 


+ 


3 


48 


uS 


+ 013 


5800 


BRA cmd_rd:Write_Msg 


+ 


3 


72 


uS 


+ 014 


0008 


0008 fetch mem 


+ 


4 


00 


uS 





— Running 
count ab 



user program 
solute 



Emulation trace complete. 



K001 



.R. 



trace step display modify break end ETC- 



H8/3048 Analysis The status qualifier "read" was used in the example trace command 
StatUS Qualifiers USeC * a ^ ove - The following analysis status qualifiers may also be used 
^€*i jc, w ith the H8/3048 emulator. 



Oualif ier 


Status Bits 


(40 


.57) 


Description 


backgrnd 


XX 


xOxx 


xxxx 


xxxx 


xxxxB 


Background cycle 


byte 


XX 


xxxx 


lxxx 


xlxx 


xxlxB 


Byte access 


cpu 


XX 


xxxx 


lxxx 


xllx 


xxxxB 


CPU access 


data 


XX 


xxxx 


lxxx 


xlxl 


xxxxB 


Data access 


dm a 


XX 


xxxx 


lxxx 


xlOx 


xxxxB 


DMA memory access 


fetch 


XX 


xxxx 


lxlx 


xllO 


xxOlB 


Fetch cycle 


f oregrnd 


XX 


xlxx 


xxxx 


xxxx 


xxxxB 


Foreground cycle 


grd 


XX 


xxOl 


lxxx 


xlxx 


lxxxB 


Guarded memory access 


intack 


XX 


xxxx 


xOxx 


xxxx 


xxxxB 


Interrupt acknowledge cycle 


io 


XX 


xxxx 


lxxx 


xlxx 


OxxxB 


Internal I/O access 


memory 


XX 


xxxx 


lxxx 


xlxx 


lxxxB 


Memory access 


nointack 


XX 


xxxx 


xlxx 


xxxx 


xxxxB 


No interrupt acknowledge cycle 


read 


XX 


xxxx 


lxxx 


xlxx 


xxxlB 


Read cycle 


refresh 


XX 


xxxx 


lxxx 


xOlx 


xxxxB 


Refresh cycle 


word 


XX 


xxxx 


lxxx 


xlxx 


xxOxB 


Word access 


write 


XX 


xxxx 


lxxx 


xlxx 


xxxOB 


Write cycle 


wr rom 


XX 


xxlO 


lxxx 


xlxx 


lxxOB 


Write to ROM cycle 
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Trace Analysis 
Considerations 



There are some points to be noticed when you use the emulation 
analyzer. 



You need to be careful to specify the condition on which the emulation 
analyzer should start the trace. Suppose that you would like to start the 
trace when the program begins executing Exe_Cmd routine: 

trace after cmd_rds . src : Exe_Cmd <RETURN> 
modify memory Cmd_Input bytes to 41h <RETURN> 

(Actually trace will be completed before you enter "modify memory" 

command) 

You will see: 



Trace List Depth= 


512 


Of f set=0 














Label: Address 




Data Opcode or 


Status 






time 


count 


Base: symbols 




hex mnemonic w/symbols 








absolute 


after cmd_rds . : Exe_ 


Cmd 


AA41 AA41 fetch mem 












+001 


cmd_rds . src : Scan 


6A2A 


MOV.B @ : Cmd_Input, R2L 




+ 


240 




nS 


+ 002 


: cmd_rds : +000010 


000F 


000F fetch mem 




+ 


480 




nS 


+ 003 


: cmd_rds : +000012 


F800 


F800 fetch mem 




+ 


720 




nS 


+ 004 


: cmd_rds : +000014 


AA00 


CMP.B #00,R2L 




+ 


1 


00 


uS 


+ 005 


: Cmd_Input 


00FF 


OOxx read mem byte 




+ 


1 


24 


uS 


+ 006 


:cmd_rds:+000016 


47F6 


BEQ cmd_rds . src : Scan 




+ 


1 


48 


uS 


+ 007 


cmd_rds . : Exe_Cmd 


AA41 


AA41 fetch mem 




+ 


1 


72 


uS 


+ 008 


cmd_rds . src : Scan 


6A2A 


MOV.B @ : Cmd_Input, R2L 




+ 


2 


00 


uS 


+ 009 


: cmd_rds : +000010 


000F 


000F fetch mem 




+ 


2 


24 


uS 


+ 010 


: cmd_rds : +000012 


F800 


F800 fetch mem 




+ 


2 


48 


uS 


+ 011 


: cmd_rds : +000014 


AA00 


CMP.B #00,R2L 




+ 


2 


72 


uS 


+ 012 


: Cmd_Input 


00FF 


OOxx read mem byte 




+ 


3 


00 


uS 


+ 013 


: cmd_rds : +000016 


47F6 


BEQ cmd_rds . src : Scan 




+ 


3 


24 


uS 


+ 014 


cmd_rds . : Exe_Cmd 


AA41 


AA41 fetch mem 




+ 


3 


48 


uS 




STATUS: H8/3048 — Running 


user program Emulation 


trace complete 






.R. . . . 


trace after cmd_rds 


. src : Exe_Cmd 














run trace 


step 


display modify 


break 




end 




--ETC — 



This is not what we were expecting to see. As you can see at the first 
line of the trace list, the address of Exe_Cmd routine appears on the 
address bus during the program executing Scan loop. This made the 
emulation analyzer start trace. To avoid mis-trigger by this cause, set 
the trigger condition to the second instruction of the routine you want 
to trace: 



How to Specify 
Trigger Condition 
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trace after cmd_rds . src : Exe_Cmd+2 <RETURN> 
(Since the instruction at Exe_Cmd label is two bytes instruction, the 
next instruction starts from Exe_Cmd+2.) 

modify memory Cmd_Input bytes to 41h <RETURN> 



Trace List Depth 


= 512 


Of f set=0 












Label: Address 




Data Opcode or Status 






time 


count 


Base: symbols 




hex mnemonic w/symbols 








absolute 


after : cmd_rds : +00001A 


5870 BEQ cmd_rds . sr : Cmd_A 










+001 


:cmd_rds:+00001C 


000A 


000A fetch mem 


+ 


240 




nS 


+ 002 


cmd_rds . sr : Cmd_A 


FB11 


MOV.B #11,R3L 


+ 


760 




nS 


+ 003 


: cmd_rds : +00002A 


7A04 


MOV.L #00002000, ER4 


+ 


1 


00 


uS 


+ 004 


: cmd_rds : +00002C 


0000 


0000 fetch mem 


+ 


1 


24 


uS 


+ 005 


: cmd_rds : +00002E 


2000 


2000 fetch mem 


+ 


1 


52 


uS 


+ 006 


:cmd_rds: +000030 


5800 


BRA cmd_rd : Write_Msg 


+ 


1 


76 


uS 


+ 007 


: cmd_rds : +000032 


0014 


0014 fetch mem 


+ 


2 


00 


uS 


+ 008 


cmd_rd : Write_Msg 


7A05 


MOV.L #000FF802, ER5 


+ 


2 


52 


uS 


+ 009 


: cmd_rds : +00004A 


000F 


000F fetch mem 


+ 


2 


76 


uS 


+ 010 


:cmd_rds:+00004C 


F802 


F802 fetch mem 


+ 


3 


00 


uS 


+ 011 


cmd_rd : Clear_01d 


FE20 


MOV.B #2 0,R6L 


+ 


3 


24 


uS 


+ 012 


cmd_r : Clear_Loop 


68D8 


MOV.B R0L, @ER5 


+ 


3 


52 


uS 


+ 013 


: cmd_rds : +000052 


0B05 


ADDS #1,ER5 


+ 


3 


76 


uS 


+ 014 


:Msg_Dest 


0000 


OOxx write mem byte 


+ 


4 


00 


uS 




STATUS: H8/3048 — 


Runninc 


user program Emulation trace complete 






.R. . . . 


modify memory Cmd 


_Input 


bytes to 41h 












run trace 


step 


display modify break 




end 




-ETC — 



If you need to see the execution of the instruction at Exe_Cmd label, 
use trace about command instead of trace after command. When you 
use the trace about command, the state which triggered the analyzer 
will appear in the center of the trace list. 



Store Condition and 
Trace 



When you specify store condition with trace only command, 
disassembling of program execution is unreliable. 



trace <RETURN> 
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Trace List Depth= 


512 


Of f set=0 














Label: Address 




Data Opcode or 


Status 






time 


count 


Base: symbols 




hex mnemonic w 


/ symbols 








absolute 


after :Cmd_Input 




OOFF OOxx read mem 


byte 










+ 001 


: cmd_rds : +000016 


47F6 


BEQ cmd_rds . src : Scan 




+ 


240 




nS 


+ 002 


cmd_rds . : Exe_Cmd 


AA41 


AA41 fetch mem 




+ 


480 




nS 


+ 003 


cmd_rds . src : Scan 


6A2A 


MOV.B @ : Cmd_Input, R2L 




+ 


720 




nS 


+ 004 


:cmd_rds: +000010 


000F 


000F fetch mem 




+ 


1 


00 


uS 


+ 005 


: cmd_rds : +000012 


F800 


F800 fetch mem 




+ 


1 


24 


uS 


+ 006 


: cmd_rds : +000014 


AA00 


CMP.B #00,R2L 




+ 


1 


48 


uS 


+ 007 


: Cmd_Input 


00FF 


OOxx read mem byte 




+ 


1 


72 


uS 


+ 008 


: cmd_rds : +000016 


47F6 


BEQ cmd_rds . src : Scan 




+ 


2 


00 


uS 


+ 009 


cmd_rds . : Exe_Cmd 


AA41 


AA41 fetch mem 




+ 


2 


24 


uS 


+ 010 


cmd_rds . src : Scan 


6A2A 


MOV.B @ : Cmd_Input, R2L 




+ 


2 


48 


uS 


+ 011 


: cmd_rds : +000010 


000F 


000F fetch mem 




+ 


2 


72 


uS 


+ 012 


: cmd_rds : +000012 


F800 


F800 fetch mem 




+ 


3 


00 


uS 


+ 013 


: cmd_rds : +000014 


AA00 


CMP.B #00,R2L 




+ 


3 


24 


uS 


+ 014 


: Cmd_Input 


OOFF 


OOxx read mem byte 




+ 


3 


48 


uS 




STATUS: H8/3048 — Running 


user program Emulation 


trace complete 






.R. . . . 


trace 


















run trace 


step 


display modify break 




end 




--ETC — 



The program is executing the Scan loop. 

Now, trace only accesses to the address range Init through Init+Offh. 
trace only range Init thru Init+Offh <RETURN> 



Trace List Depth 


= 512 


Of f set=0 














Label: Address 




Data Opcode or 


Status 






time 


count 


Base: symbols 




hex mnemonic w/symbols 








absolute 


after : cmd_rds : +000012 


F800 F800 fetch mem 












+001 


: cmd_rds : +000014 


AA00 


AA00 fetch mem 




+ 


240 




nS 


+ 002 


: cmd_rds : +000016 


47F6 


BEQ cmd_rds . src : Scan 




+ 


720 




nS 


+ 003 


cmd_rds . : Exe_Cmd 


AA41 


AA41 fetch mem 




+ 


1 


00 


uS 


+ 004 


cmd_rds . src : Scan 


6A2A 


MOV.B @ : Cmd_Input, R2L 




+ 


1 


24 


uS 


+ 005 


: cmd_rds : +000010 


000F 


000F fetch mem 




+ 


1 


48 


uS 


+ 006 


: cmd_rds : +000012 


F800 


F800 fetch mem 




+ 


1 


72 


uS 


+ 007 


: cmd_rds : +000014 


AA00 


AA00 fetch mem 




+ 


2 


00 


uS 


+ 008 


: cmd_rds : +000016 


47F6 


BEQ cmd_rds . src : Scan 




+ 


2 


48 


uS 


+ 009 


cmd_rds . : Exe_Cmd 


AA41 


AA41 fetch mem 




+ 


2 


72 


uS 


+ 010 


cmd_rds . src : Scan 


6A2A 


MOV.B @ : Cmd_Input, R2L 




+ 


3 


00 


uS 


+ 011 


: cmd_rds : +000010 


000F 


000F fetch mem 




+ 


3 


24 


uS 


+ 012 


: cmd_rds : +000012 


F800 


F800 fetch mem 




+ 


3 


48 


uS 


+ 013 


: cmd_rds : +000014 


AA00 


AA00 fetch mem 




+ 


3 


72 


uS 


+ 014 


: cmd_rds : +000016 


47F6 


BEQ cmd_rds . src : Scan 




+ 


4 


24 


uS 




STATUS: H8/3048 — 


Running user program Emulation 


trace complete 






.R. . . . 


trace only range 


Init 


thru Init+Offh 














run trace 


step 


display modify 


break 




end 




--ETC — 
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As you can see the execution of CMP.B instructions are not 
disassembled. This occurs when the analyzer cannot get necessary 
information for disassembling because of the store condition. Be 
careful when you use the trace only command. 

Triggering the You may want to trigger the emulation analyzer when specific data 
Analyzer by Data appears on the data bus. You can accomplish this with the following 

command. 

trace after data <data> <RETURN> 

There are some points to be noticed when you trigger the analyzer in 
this way. You always need to specify the <data> with 16 bits value 
even when access to the data is performed by byte access. This is 
because the analyzer is designed so that it can capture data on internal 
data bus (which has 16 bits width). The following table shows the way 
to specify the trigger condition by data. 



Location of I Access 
data I size 



Address 
value 



Available 
<data> Specification 



bit data | byte/word 
bus area 



even 
+- 

odd 



ddxx 
xxdd 



byte 



16 bit data 
bus area 



even 
odd 

+ 

word I even 



ddxx 
xxdd 
hhll 



*1 
*1 
*2 



*1 dd means 8 bits data 
*2 hhll means 16 bits data 



For example, to trigger the analyzer when the processor performs word 
access to data 1234 hex in 16 bit bus area, you can specify the 
following: 

trace after data 1234h <RETURN> 



To trigger the analyzer when the processor accesses data 12 hex to the 
even address located in 8 bit data bus area: 

trace after data 12xxh <RETURN> 
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On the other hand, to trigger 12 hex to the odd address located in 8 bit 
data bus. 

trace after data xxl2h <RETURN> 

Notice that you always need to specify "xx" value to capture byte 
access to 8 bit data bus area. Be careful to trigger the analyzer by data. 



For a Complete 
Description 



For a complete description of using the HP 64700 Series analyzer with 
the Softkey Interface, refer to the Analyzer Softkey Interface User's 
Guide. 



Exiting the 
Softkey Interface 



There are several options available when exiting the Softkey Interface: 
exiting and releasing the emulation system, exiting with the intent of 
reentering (continuing), exiting locked from multiple emulation 
windows, and exiting (locked) and selecting the measurement system 
display or another module. 



End Release System 



To exit the Softkey Interface, releasing the emulator so that other users 
may use the emulator, enter the following command. 

end release_system <RETURN> 



Ending to Continue 
Later 



You may also exit the Softkey Interface without specifying any 
options; this causes the emulator to be locked. When the emulator is 
locked, other users are prevented from using it and the emulator 
configuration is saved so that it can be restored the next time you enter 
(continue) the Softkey Interface. 

end <RETURN> 



Ending Locked from 
All Windows 



When using the Softkey Interface from within window systems, the 
"end" command with no options causes an exit only in that window. 
To end locked from all windows, enter the following command. 

end locked <RETURN> 



This option only appears when you enter the Softkey Interface via the 
emul700 command. When you enter the Softkey Interface v ia pmon 
and MEAS_SYS, only one window is permitted. 
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Selecting the 
Measurement System 
Display or Another 
Module 



Refer to the Softkey Interface Reference manual for more information 
on using the Softkey Interface with window systems. 

When you enter the Softkey Interface via pmon and MEAS_SYS, you 
have the option to select the measurement system display or another 
module in the measurement system when exiting the Softkey Interface. 
This type of exit is also "locked"; that is, you can continue the 
emulation session later. For example, to exit and select the 
measurement system display, enter the following command. 

end select measurement_system <RETURN> 

This option is not available if you have entered the Softkey Interface 
via the emul700 command. 
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Notes 
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3 



In-Circuit Emulation 



When you are ready to use the H8/3048 emulator in conjunction with 
actual target system hardware, there are some special considerations 
you should keep in mind. 

■ installing the emulation cable 

■ properly configure the emulator 

We will cover the first topic in this chapter. For complete details on 
in-circuit emulation configuration, refer to Chapter 4. 
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Installing the 
Target System 
Probe 



Caution BHj T' le following precautions should be taken while using the H8/3048 

emulator. Damage to the emulator circuitry may result if these 
precautions are not observed. 

Power Down Target System. Turn off power to the user target system 
and to the H8/3048 emulator before attaching and detaching the adaptor 
and probe to the emulator or target system to avoid circuit damage 
resulting from voltage transients or mis-insertion. 

Verify User Plug Orientation. Make certain that Pin 1 of the QFP 

socket/adaptor and Pin 1 of the QFP probe are properly aligned before 
inserting the QFP probe the QFP socket/ adaptor. Failure to do so may 
result in damage to the emulator circuitry. 

Protect Against Static Discharge. The H8/3048 emulator and the 
PGA adaptor and QFP probe contain devices which are susceptible to 
damage by static discharge. Therefore, operators should take 
precautionary measures before handling the user plug to avoid emulator 
damage. 

Protect Target System CMOS Components. If your target system 
includes any CMOS components, turn on the target system first, then 
turn on the H8/3048 emulator; when powering down, turn off the 
emulator first, then turn off power to the target system. 



3-2 In-Circuit Emulation 



The H8/3048 emulator is provided without any PGA adaptor, QFP 
adaptor and QFP probe. To emulate each processor with your target 
system, you need to purchase appropriate adaptor and/or probe. 



PGA adaptor To emulate each processor with your target system, you can use HP 

64784E 5 voltage PGA adaptor or HP 64797B low voltage PGA 
adaptor as shown in Figure 3-1 and 3-3. These PGA adaptors allow you 
to connect the emulation cable to QFP socket/ adaptor on your target 
system using the HP 64784G QFP probe. HP 64784G QFP probe is 
flexible and comfortable to connect the PGA adaptor to a densely 
populated circuit board. 

If you want to connect the PGA adaptor to your target system directly, 
you need to prepare PGA socket on your target system. To prepare the 
PGA socket, refer to Table 3-2 and Figure 3-5 to know H8/3048 pin 
assignment. 



QFP adaptor To emulate with your target system running with supply voltage 5V, 
you can also use HP 64784D QFP adaptor. The QFP adaptor allows 
you to connect the emulation cable to the QFP socket/adapter on your 
target system as shown in Figure 3-2. 



QFP SOCket/adaptOr The QFP socket/adaptor designed for H8/3048 microprocessor is 

provided with the QFP adaptor and QFP probe. You must attach the 
QFP socket/adaptor to your target system except you connect the PGA 
adaptor to your target system directly. 

When you use this QFP socket/adaptor, you can replace the H8/3048 
emulator with actual H8/3048 microprocessor. Refer to Figure 3-4. 



Note 




You can order additional QFP socket/adaptor with part No. HP 
64784-61612. 
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Installing into a 5 
voltage target 



You can select either of the followings to connect the H8/3048 
emulator to your 5 voltage target. 



HP 64784D 

HP 64784E + HP 64784G 



4 



Note S The H8/3048 emulator can only operate rightly with supply voltage 

from 4.75V to 5 .25V, when you use HP 64784E PGA adaptor or HP 
64784D QFP adaptor. 



4 



Note M -£ If you have a HP 64797B low voltage PGA adaptor, you can use this 

low voltage PGA adaptor instead of HP 64784E 5 voltage PGA 
adaptor. HP 64797B low voltage PGA adaptor can operate rightly with 
supply voltage from 2.70V to 5.25V. 



Note 




You must use a clock conforming to the specification of Table 4-1, 
when you configure the emulator to use external clock. 
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Installing 64784E 

PGA adaptor 1. Attach the QFP socket/adaptor to your target system. 



2. Connect the PGA adaptor to the emulation cable. 

3. Install the PGA adaptor to the QFP socket/adaptor on your 
target system through QFP probe as shown in Figure 3-1. 




Figure 3-1 Installing HP 64784E/HP 64784G 
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Installing QFP 

adaptor 4. Attach the QFP socket/adaptor to your target system. 

5. Connect the QFP adaptor to the emulation cable. 

6. Install the QFP adaptor to the QFP socket/adaptor on your 
target system as shown in Figure 3-2. 




Figure 3-2 Installing HP 64784D 
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Installing into a 
low voltage target 



To connect the emulator into a low voltage target, you should use HP 
64797B PGA adaptor and 64784G QFP probe. 



Specification 



The emulator can only operate rightly with supply voltage from 2.7V 
up to 5.25V. You must conform input high voltage(Vih) to the 
specification of Table 3-1, because these DC characteristics are 
different from the actual processor's specification. 

Table 3-1. DC Characteristics of input high voltage 



Item 


Minimum (V) 


PI - P5, DO - D15 


Vcc x 0.7 




or 




2.4*1 


Others 


Vcc x 0.7 




or 




2.0*1 



: 1 Higher of the two. 



Note 



4 



You must use a clock conforming to the specification of Table 4-1, 
when you configure the emulator to use external clock. 
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Installing 64797B 
PGA adaptor 



1. Attach the QFP socket/adaptor to your target system. 



2. Connect the PGA adaptor to the emulation probe. 

3. Install the PGA adaptor to the QFP socket/adaptor on your 
target system through QFP probe as shown in Figure 3-3. 




Figure 3-3 Installing HP 64797B/HP 64784G 
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1 11 Sta 1 1 i 11 g the You can replace the QFP adaptor/probe with the H8/3048 

H8/3048 microprocessor. 

microprocessor 





Figure 3-4 Installing the H8/3048 processor 
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In-Circuit 
Configuration 
Options 



The H8/3048 emulator provides configuration options for the following 
in-circuit emulation issues. 



Refer to the Chapter 4 "Configuring the Emulator" for more 
information on these configuration options. 



Using the Target System Clock Source 

You can configure the emulator to use the external target system clock 
source. 

Enabling Bus Arbitration 

You can configure the emulator to enable/disable bus arbitration. 
Enabling NMI from the Target 

You can configure the emulator to accept/ignore NMI from the target 
system. 

Enabling /RES signal from the Target 

You can configure the emulator to accept/ignore /RES signal from the 
target system. 

Selecting Visible/Hidden Background Cycles 

Emulation processor activity while executing in background can either 
be visible to target system (cycles are sent to the target system probe) 
or hidden (cycles are not sent to the target system probe). 

Selecting Target Memory Access Size 

You can specify the types of cycles that the emulation monitor uses 
when accessing target system memory. 
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Target System 
Interface and 



Timing 
Specification 



Refer to the H8/3048 Terminal Interface User's Guide for information 
on the target system interface and timing specification of the H8/3048 
emulator. 



Running the 
Emulator from 
Target Reset 



You can specify that the emulator begins executing from target system 
reset. When the target system /RES line becomes active and then 
inactive, the emulator will start reset sequence (operation) as actual 
microprocessor. 



At First, you must specify the emulator responds to /RES signal by the 
target system (see the "Enable /RES input from target system?" 
configuration in Chapter 4 of this manual). 

To specify a run from target system reset, select: 
run from reset <RESET> 



The status now shows that the emulator is "Awaiting target reset". 
After the target system is reset, the status line message will change to 
show the appropriate emulator status. 



4 



Note Ms! In the "Awaiting target reset", you can not break into the monitor. If 

you enter "run from reset" in out-of-circuit or in the configuration that 
emulator does not accept target system reset (cf trst=dis), you must 
reset the emulator. 
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When you connect the PGA adaptor to your target system directly, 
pin assignment of your target PGA socket must be compatible with the 
PGA adaptor pin assignment. The following table and figure show you 
the pin assignment of the PGA adaptor. 

Table 3-2 PGA Pin Assignment 



PGA 
135 
pin# 


QFP 
100 
pin# 


Function 
name 


PGA 
135 
pin# 


QFP 
100 
pin 


Function 
name 


1 


98 


PA/TP5/TIOCB 1/A22/CS5 


15 


21 


P43/D3 


2 


1 


Vcc 


16 


25 


P46/D6 


3 


3 


PB1/TP9/TIOCB3 


17 


27 


P30/D8 


4 




nc 


18 


30 


P33/D11 


5 


8 


PB6/TP14/DREQ0/CS7 


19 


31 


P34/D12 


6 




nc 


20 


33 


P36/D14 


7 




nc 


21 


34 


P37/D15 


8 




nc 


22 




nc 


9 




nc 


23 


37 


Pll/Al 


10 




nc 


24 


40 


P14/A4 


11 


14 


P92/RxD0 


25 


43 


P17/A7 


12 


17 


P95/SCK1/IRQ5 


26 


57 


Vss 


13 


18 


P40/D0 


27 




nc 


14 




nc 


28 


49 


P24/A12 



PGA Pin 
Assignments 
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Table 3-2 PGA Pin Assignment (Cont'd) 



PGA 
135 
pin# 


QFP 
100 
pin# 


Function 
njimc 


PGA 
135 
pin# 


QFP 
100 
pin# 


Function 
njnnc 


29 


52 


P27/A15 


47 




nc 


30 


54 


P51/A17 


48 


88 


P81/CS3/IRQ1 


31 




nc 


49 


89 


P82/CS2/IRQ2 


32 


58 


P60AVAIT 


50 


91 


P84/CS0 


33 


61 


0 


51 


95 


PA2/TP2/TIOCA0/TCLKC 


34 


64 


NMI 


52 


97 


PA4/TP4/TIOCA1/A23/CS6 


35 


65 


Vss 


53 




nc 


36 


68 


Vcc 


54 


2 


PB0/TP8/TIOCA3 


37 




nc 


55 


5 


PB3/TP1 1/TIOCB4 


38 


72 


P66/LWR 


56 


7 


PB5/TP 1 3/TOCXB4 


39 


75 


MD2 


57 


11 


Vss 


40 


76 


AVcc 


58 




nc 


41 


80 


P72/AN2 


59 




nc 


42 


81 


P73/AN3 


60 




nc 


43 


84 


P76/AN6/DA0 


61 


12 


P90/TxD0 


44 




nc 


62 


15 


P93/RxDl 


45 


92 


Vss 


63 




nc 


46 




nc 


64 


19 


P41/D1 
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Table 3-2 PGA Pin Assignment (Cont'd) 



PGA 
135 
pin# 


QFP 
100 
pin# 


Function 
njimc 


PGA 
135 
pin# 


QFP 
100 
pin# 


Function 
njnnc 


65 




nc 


83 




nc 


66 


24 


P45/D5 


84 


70 


P64/RD 


67 


44 


Vss 


85 


73 


MD0 


68 


28 


P31/D9 


86 




nc 


69 


32 


P35/D13 


87 


79 


P71/AN1 


70 


35 


Vcc 


88 


83 


P75/AN5 


71 


36 


P10/A0 


89 


86 


AVss 


72 


38 


P12/A2 


90 




nc 


73 


41 


P15/A5 


91 




nc 


74 


45 


P20/A8 


92 


87 


P80/RFSH/IRQ0 


75 


48 


P23/A1 1 


93 


90 


P83/CS1/IRQ3 


76 


51 


P26/A14 


94 


93 


PA0/TP0/TEND0/TCLKA 


77 




nc 


95 




nc 


78 


55 


P52/A18 


96 


99 


PA6/TP6/TIOCA2/A21/CS4 


79 




nc 


97 




nc 


80 


59 


P61/BREQ 


98 


4 


PB2/TP10/TIOCA4 


81 


63 


RES 


99 


6 


PB4/TP 1 2/TOCXA4 


82 


66 


EXTAL 


100 


9 


PB7/TP15/DREQ1/ADTRG 
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Table 3-2 PGA Pin Assignment (Cont'd) 



PGA 
135 
pin# 


QFP 
100 
pin# 


Function 
njimc 


PGA 
135 
pin# 


QFP 
100 
pin# 


Function 
njnnc 


101 




nc 


119 


60 


P62/BACK 


102 




nc 


120 


62 


STBY 


103 


10 


RESO 


121 


67 


XTAL 


104 


13 


P91/TxDl 


122 


69 


P63/AS 


105 


16 


P94/SCK0/IRQ4 


123 


71 


P65/HWR 


106 


22 


Vss 


124 


74 


MD1 


107 


20 


P42/D2 


125 


78 


P70/AN0 


108 


23 


P44/D4 


126 


82 


P74/AN4 


109 


26 


P47/D7 


127 


85 


P77/AN7/DA1 


110 


29 


P32/D10 


128 




nc 


111 




nc 


129 




nc 


112 


39 


P13/A3 


130 


94 


PA 1 /TP 1 /TEND 1 /TCLKB 


113 


42 


P16/A6 


131 


96 


PA3/TP3/TIOCB0/TCLKD 


114 


46 


P21/A9 


132 


100 


PA7/TP7/TIOCB2/A20 


115 


50 


P25/A13 


133 




nc 


116 


53 


P50/A16 


134 


47 


P22/A10 


117 




nc 


135 


77 


Vref 


118 


56 


P53/A19 
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Figure 3-5 PGA Adaptor Pin Assignment 
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Configuring the Emulator 



Introduction Your H8/3048 emulator can be used in all stages of target system 

development. For instance, you can run the emulator out-of-circuit 
when developing your target system software, or you can use the 
emulator in-circuit when integrating software with target system 
hardware. 

You can use the emulator' s internal clock or the target system clock. 
Emulation memory can be used in place of, or along with, target system 
memory. 

You can execute target programs in real-time or allow emulator 
execution to be diverted into the monitor when commands request 
access of target system resources (target system memory, register 
contents, etc). 

The emulator is a flexible instrument and may be configured to suit 
your needs at any stage of the development process. This chapter 
describes the options available when configuring the H8/3048 emulator. 

The configuration options are accessed with the following command. 
modify configuration <RETURN> 

After entering the command above, you will be asked questions 
regarding the emulator configuration. The configuration questions are 
listed below and grouped into the following classes. 
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General Emulator Configuration: 

■ Specifying the emulator clock source (internal/external). 

■ Selecting monitor entry after configuration. 

■ Restricting to real-time execution. 

■ Selecting the microprocessor to be emulated. 

■ Selecting the microprocessor operation mode. 

Memory Configuration: 

■ Mapping memory. 

Emulator Pod Configuration: 

■ Enabling emulator bus arbitration. 

■ Enabling NMI input from the target system. 

■ Enabling reset input from the target system. 

■ Allowing the emulator to drive background cycles to the target 
systems. 

■ Setting up the reset value for the stack pointer. 

■ Selecting target memory access size. 

Debug/Trace Configuration: 

■ Enabling breaks on writes to ROM. 

■ Specifying tracing of foreground/background cycles. 

■ Enabling tracing internal DMA cycles. 

■ Enabling tracing refresh cycles. 
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Simulated I/O Configuration: Simulated I/O is described in the 
Simulated I/O reference manual. 

Interactive Measurement Configuration: See the chapter on 
coordinated measurements in the Softkey Interface Reference manual. 

External Analyzer Configuration: See the Analyzer Softkey 
Interface User's Guide. 



General Emulator 
Configuration 



The configuration questions described in this section involve general 
emulator operation. 



Micro-processor 
clock source? 



This configuration question allows you to select whether the emulator 
will be clocked by the internal clock source or by a target system clock 
source. 



internal 



Selects the internal crystal oscillator as the emulator 
clock source. Internal crystal oscillator is 8MHz. 



external 



Selects the clock input to the emulation probe from 
the target system. You must use a clock input 
conforming to the specifications of Table 4-1. 
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Table 4-1 . Clock Speeds 



Emulation 
Memory 


Clock Speed 


With HP64784D 


With HP64784E 


With HP64797B 


64726A 
64727A 
64728A 


From 1 up to 16MHz 
(System Clock) 


From 1 up to 16MHz 
(System Clock) 


From 1 up to 13MHz 
(System Clock) 


64729A 


From 1 up to 18MHz 
(System Clock) 


From 1 up to 18MHz 
(System Clock) 


From 1 up to 13MHz 
(System Clock) 



Note 




Internal crystal oscillator frequency is 8MHz. 



4 



Note m»| Changing the clock source drives the emulator into the reset state. The 

emulator may later break into the monitor depending on how the 
following "Enter monitor after configuration?" question is answered. 
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Enter monitor after 
configuration? 



This question allows you to select whether the emulator will be running 
in the monitor or held in the reset state upon completion of the 
emulator configuration. 



How you answer this configuration question is important in some 
situations. For example, when the external clock has been selected and 
the target system is turned off, reset to monitor should not be selected; 
otherwise, configuration will fail. 

When an external clock source is specified, this question becomes 
"Enter monitor after configuration (using external clock)?" and the 
default answer becomes "no". 

yes When reset to monitor is selected, the emulator will 

be running in the monitor after configuration is 
complete. If the reset to monitor fails, the previous 
configuration will be restored. 

no After the configuration is complete, the emulator 

will be held in the reset state. 

Restrict tO real-time The "restrict to real-time" question lets you configure the emulator so 
rims? mat commands which cause the emulator to break to monitor and 
return to the user program are refused. 

no All commands, regardless of whether or not they 

require a break to the emulation monitor, are 
accepted by the emulator. 

yes When runs are restricted to real-time and the 

emulator is running the user program, all commands 
that cause a break (except "reset", "break", "run", 
and "step") are refused. For example, the following 
commands are not allowed when runs are restricted 
to real-time: 

■ Display/modify registers. 

■ Display/modify internal I/O registers. 

■ Display/modify target system memory. 

■ Load/store target system memory. 



Configuring the Emulator 4-5 



Caution 



If your target system circuitry is dependent on constant execution of 
program code, you should restrict the emulator to real-time runs. This 
will help insure that target system damage does not occur. However, 
remember that you can still execute the "reset", "break", and "step" 
commands; you should use caution in executing these commands. 



Processor type? This configuration defines the microprocessor type to be emulated. 



3044 



When you are going to emulate H8/3044 
microprocessor, select this item. 



3047 



When you are going to emulate H8/3047 
microprocessor, select this item. 



3048 



When you are going to emulate H8/3048 
microprocessor, select this item. 



Note 



4 



3048f 



When you are going to emulate H8/3048F 
microprocessor, select this item. 



Configuring this item will drive the emulator into the reset state. 
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Source for processor This configuration defines operation mode in which the emulator works. 

operation mode? 

internal The emulator will work in selected operation mode 

regardless the setting by the target system. 

Operation mode Description 

mode_l The emulator will operate in mode 1 . (expanded 1M 

bytes mode without internal ROM: 8 bit data bus) 

mode_2 The emulator will operate in mode 2. (expanded 1M 

bytes mode without internal ROM: 16 bit data bus) 

mode_3 The emulator will operate in mode 3 . (expanded 

16M bytes mode without internal ROM: 8 bit data 
bus) 

mode_4 The emulator will operate in mode 4. (expanded 

16M bytes mode without internal ROM: 16 bit data 
bus) 

mode_5 The emulator will operate in mode 5. (expanded 1M 

bytes mode with internal ROM: 8 bit data bus) 

mode_6 The emulator will operate in mode 6. (expanded 

16M bytes mode with internal ROM: 8 bit data bus) 

mode_7 The emulator will operate in mode 7. (single chip 

advanced mode) 
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external 



The emulator will work using the mode setting by 
the target system. The target system must supply 
appropriate input to MDO, MD1 and MD2. 



Note 




It is recommended to configure this item as internal mode and select 
operation mode, since the emulator dose not work fine when MDO, 
MD1 and MD2 are not steady. 



Note 




Configuring this item will drive the emulator into the reset state. 
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Memory 
Configuration 



The memory configuration questions allow you to select the monitor 
type and to map memory. To access the memory configuration 
questions, you must answer "yes" to the following question. 



Modify memory configuration? 

Mapping Memory The H8/3048 emulator contains high-speed emulation memory (no wait 

states required) that can be mapped at a resolution of 512 bytes. 

The memory mapper allows you to characterize memory locations. It 
allows you specify whether a certain range of memory is present in the 
target system or whether you will be using emulation memory for that 
address range. You can also specify whether the target system memory 
is ROM or RAM, and you can specify that emulation memory be 
treated as ROM or RAM. 

The memory mapper allows you to define up to 16 different map terms . 



Note 




Direct memory access to emulation memory using external DMAC are 
not allowed. 



Note 




The default emulator configuration maps location 0 hex through FFFF 
hex as emulation ROM. 
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Note S When you use internal ROM/on-chip flash memory area, you must 

map that area as emulation memory. If you don't map internal ROM 
properly, you cannot access that area. 
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Note Ha You don't have to map internal RAM as emulation RAM, since the 

H8/3048 emulator automatically maps internal RAM as emulation 
RAM and this area is behaved like internal RAM. However emulation 
memory system does not introduce internal RAM area in memory 
mapping display. 



4 



Note I If you map internal RAM area as emulation memory, this area is 

behaved like external memory overlapped with internal RAM and the 
H8/3048 emulator is always accessed internal RAM area mapped by 
the emulator. And if you map internal RAM as guarded memory, the 
emulator prohibits to access to this area by display /modify memory 
commands. 



Blocks of memory can also be characterized as guarded memory. 
Guarded memory accesses will generate "break to monitor" requests. 
Writes to ROM will generate "break to monitor" requests if the "Enable 
breaks on writes to ROM?" configuration item is enabled (see the 
"Debug/Trace Configuration" section which follows). 

For example, you might be developing a system with the following 
characteristics: 

■ input port at OfOOO hex 

■ output port at Of 1 00 hex 

■ program and data from 1000 through 2fff hex 



Suppose that the only thing that exists in your target system at this time 
are input and output ports and some control logic; no memory is 
available, you can reflect this by mapping the I/O ports to target system 
memory space and the rest of memory to emulation memory space: 
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delete all <RETURN> 

lOOOh thru 2fffh emulation rom <RETURN> 
OfOOOh thruOO Oflffh emulation ram <RETURN> 
end <RETURN> 

When mapping memory for your target system programs, you may 
wish to characterize emulation memory locations containing programs 
and constants (locations which should not be written to) as ROM. This 
will prevent programs and constants from being written over 
accidentally, and will cause breaks when instructions attempt to do so. 



You should map all memory ranges used by your programs before 
loading programs into memory. This helps safeguard against loads 
which accidentally overwrite earlier loads if you follow a map/load 
procedure for each memory range. 



Configuring memory mapping will drive the emulator into the reset 
state. 
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Emulator Pod To access the emulator pod configuration questions, you must answer 

Conf igU ration yeS t0 the followin g question- 



Modify emulator pod configuration? 

Enable bUS The bus arbitration configuration question defines how your emulator 
arbitration? responds to bus request signals from the target system during both 
foreground and background operation. 

yes When bus arbitration is enabled, the /BREQ (bus 

request) signal from the target system is responded 
to exactly as it would be if only the emulation 
processor was present without an emulator. In 
other words, if the emulation processor receives a 
/BREQ from the target system, it will respond by 
asserting /BACK and will set the various processor 
lines to tri-state. /BREQ is then released by the 
target; /BACK is negated by the processor, and the 
emulation processor restarts execution. 



You cannot perform DMA (direct memory access) transfers between 
your target system and emulation memory by using external DMA 
controller on your target system; the H8/3048 emulator does not 
support such a feature. 




no When you disable bus arbitration, the emulator 

ignores the /BREQ signal from the target system. 
The emulation processor will never drive the 
/BACK line true; nor will it place the address, data 
and control signals into the tri-state mode. 
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Note 



4 



Enabling and disabling bus master arbitration can be useful to you in 
isolating target system problems. For example, you may have a 
situation where the processor never seems to execute any code. You 
can disable bus arbitration to check and see if faulty arbitration 
circuitry in your target system is contributing to the problem. 



This question does not appear when you select mode_7. 



Note 



4 



The commands which cause the emulator to break to monitor are 
ignored during the processor releases bus cycles. 



Note 



4 



Configuring this item will drive the emulator into the reset state. 



Enable NMI input 
from target system? 



This configuration allows you to specify whether or not the emulator 
responds to NMI (non-maskable interrupt request) signal from the 
target system during foreground operation. 



yes 



The emulator will respond to the NMI request from 
the target system. 



Caution 



While the emulator is executing the boot program of H8/3048F, the 
NMI must not occur. Because the emulator can not prohibit the NMI at 
this time. 



no 



The emulator will not respond to the NMI request 
from the target system. 
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The emulator does not accept any interrupt while in background 
monitor. Such interrupts are suspended while running the background 
monitor, and they will occur when context is changed to foreground. 



Note 




Configuring this item will drive the emulator into the reset state. 



Enable reset input This configuration allows you to specify whether or not the emulator 
from target System? responds to /RES and /STBY signals from the target system during 

foreground operation. 

While running the background monitor, the emulator ignores such 
signals except that the emulator' s status is "Awaiting target reset" 
(see the "Running the Emulation from Target Reset" section in the 
"In-Circuit Emulation" chapter). 

yes The emulator will respond to /RES and /STBY 

inputs during foreground operation. 

no The emulator will not respond to /RES and /STBY 

inputs from the target system. 



Note 




The H8/3048 emulator dose not support hardware standby mode, and 
/STBY input will be given the emulator /RES input. 



Note 




Configuring this item will drive the emulator into the reset state. 
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Drive background 
cycles to the target 
system? 



This configuration allows you specify whether or not the emulator will 
drive the target system bus on background cycles. 



no Only emulation processor's address cycles are 

driven to the target system during background 
monitor. 

yes Specifies that background cycles are driven to the 

target system. Emulation processor's address and 
control strobes (except /HWR and /LWR) are 
driven during background cycles. Background 
write cycles won't appear to the target system. 



Note 




Refresh cycles, internal DMA cycles and target memory accesses are 
always driven to the target system regardless of this configuration. 
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Note H ^ y° u s P ec ify mat me emulator will not drive background cycles to the 

target system, the emulator can't respond to /WAIT signal during 
background monitor. 



Note 




This question does not appear when you select mode_7. 



Note 




Configuring this item will drive the emulator into the reset state. 
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Reset value for stack 
pointer? 



This configuration allows you to specify a value to which the stack 
pointer will be set upon the transition from emulation reset into the 
emulation monitor. 

The address specified in response to this question must be a 32-bit 
hexadecimal even address outside internal I/O register area. Default 
value of stack pointer is fffffflO hex. 



Note 



4 



Without a stack pointer, the emulator is unable to make the transition to 
the run state, step, or perform many other emulation functions. 
However, using this option does not preclude you from changing the 
stack pointer value or location within your program; it just sets the 
initial conditions to allow a run to begin. 



Target memory This configuration allow you to specify the types of cycles that the 
aCCeSS Size? emulation monitor uses when accessing target system memory. 



any 



bytes 



words 



Access size is depends upon a display/modify target 
memory command option. If option "long" is 
specified, access size is will be set to "words". 
Other target memory commands such as "load" and 
"store" will use as access size of "bytes". 

Specify that the emulator will access target system 
memory by byte access. 

Specify that the emulator will access target system 
memory by word access. 
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Debug/Trace 
Configuration 



Break processor on 
write to ROM? 



When the access size is words, modifying target memory will fail if 
you try to modify memory from an odd address or with data which byte 
count is odd. Also, you can't load file which byte count is odd. 
Therefore, it is recommended to use the emulator with the default any 
or bytes in this configuration 



The debug/trace configuration questions allows you to specify breaks 
on writes to ROM, and specify that the analyzer trace 
foreground/background execution, and bus release cycles. To access 
the trace/debug configuration questions, you must answer "yes" to the 
following question. 

Modify debug/trace options? 

This question allows you to specify that the emulator break to the 
monitor upon attempts to write to memory space mapped as ROM. 
The emulator will prevent the processor from actually writing to 
memory mapped as emulation ROM; however, the emulator cannot 
prevent writes to target system RAM locations which are mapped as 
ROM, even though the write to ROM break is enabled. 

yes Causes the emulator to break into the emulation 



monitor whenever the user program attempts to 
write to a memory region mapped as ROM. 



no 



The emulator will not break to the monitor upon a 
write to ROM. The emulator will not modify the 
memory location if it is in emulation ROM. 
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Note 



4 



The wrrom trace command status options allow you to use 
"write to ROM" cycles as trigger and storage qualifiers. For example, 
you could use the following command to trace about a write to ROM: 
trace about status wrrom <RETURN> 



Note 



4 



If the emulator writes to the memory mapped as ROM or guarded area 
in internal DMA cycles, the emulator will not break to the monitor 
regardless of this configuration. 



Trace background or 
foreground 
operation? 



This question allows you to specify whether the analyzer traces only 
foreground emulation processor cycles, only background cycles, or 
both foreground and background cycles. When background cycles are 
stored in the trace, all mnemonic lines are tagged as background cycles. 



foreground Specifies that the analyzer traces only foreground 

cycles. This option is specified by the default 
emulator configuration. 

background Specifies that the analyzer traces only background 
cycles. (This is rarely a useful setting.) 



both 



Specifies that the analyzer traces both foreground 
and background cycles. 



Trace on-chip DMAC 
cycles? 



This question allows you to specify whether or not the emulator traces 
internal DMAC cycles. 



yes 



Specifies that the analyzer traces internal DMAC 
cycles. 



no 



Specifies that the analyzer dose not trace internal 
DMAC cycles. 
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Note 



4 



Some internal DMA cycles may be traced regardless of this 
configuration in order to disassemble the trace list correctly. 



Trace refresh cycles? 



This configuration allows you to specify whether or not the emulator 
traces refresh cycles. 



yes 



no 



Specifies that the analyzer traces refresh cycles. 

Specifies that the analyzer dose not trace refresh 
cycles. 



Note 



Note 



4 
4 



Some refresh cycles may be traced regardless of this configuration in 
order to disassemble the trace list correctly. 



This configuration does not appear when you select mode_7. 



Simulated I/O 
Configuration 



The simulated I/O feature and configuration options are described in 
the Simulated I/O reference manual. 
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Interactive 

Measurement 

Configuration 



The interactive measurement configuration questions are described in 
the chapter on coordinated measurements in the Softkey Interface 
Reference manual. Examples of coordinated measurements that can be 
performed between the emulator and the emulation analyzer are found 
in the "Using the Emulator" chapter. 



External Analyzer 
Configuration 



The external analyzer configuration options are described in the 
Analyzer Softkey Interface User's Guide. 



Saving a 
Configuration 



The last configuration question allows you to save the previous 
configuration specifications in a file which can be loaded back into the 
emulator at a later time. 



Configuration file name? <FILE> 

The name of the last configuration file is shown, or no filename is 
shown if you are modifying the default emulator configuration. 

If you press <RETURN> without specifying a filename, the 
configuration is saved to a temporary file. This file is deleted when 
you exit the Softkey Interface with the "end release_system" command. 

When you specify a filename, the configuration will be saved to two 
files; the filename specified with extensions of ".EA" and ".EB". The 
file with the ".EA" extension is the "source" copy of the file, and the 
file with the ".EB" extension is the "binary" or loadable copy of the file. 

Ending out of emulation (with the "end" command) saves the current 
configuration, including the name of the most recently loaded 
configuration file, into a "continue" file. The continue file is not 
normally accessed. 
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Loading a 
Configuration 



Configuration files which have been previously saved may be loaded 
with the following Softkey Interface command. 



load configuration <FILE> <RETURN> 
This feature is especially useful after you have exited the Softkey 
Interface with the "end release_system" command; it saves you from 
having to modify the default configuration and answer all the questions 
again. 

To reload the current configuration, you can enter the following 
command. 

load configuration <RETURN> 
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Using the Emulator 

Introduction In the "Getting Started" chapter, you learned how to load code into the 

emulator, how to modify memory and view a register, and how to 
perform a simple analyzer measurement. In this chapter, we will 
discuss in more detail other features of the emulator. 

This chapter discusses: 

■ Features available via "pod_command". 

■ Register classes and names. 

■ Debugging C Programs 

■ Accessing target system devices using E clock synchronous 
instruction. 

This chapter shows you how to: 

■ Store the contents of memory into absolute files. 

■ Make coordinated measurements. 

■ Use a command file. 
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Features Available 
via Pod 
Commands 



Several emulation features available in the Terminal Interface but not 
in the Softkey Interface may be accessed via the following emulation 
commands. 



display pod_command <RETURN> 

pod_command ' <Terminal Interface command>' 
<RETURN> 

Some of the most notable Terminal Interface features not available in 
the softkey Interface are: 

■ Copying memory. 

■ Searching memory for strings or numeric expressions. 

■ Performing coverage analysis. 

Refer to your Terminal Interface documentation for information on 
how to perform these tasks. 
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Note | Be careful when using the "pod_command". The Softkey Interface, 

and the configuration files in particular, assume that the configuration 
of the HP 64700 pod is NOT changed except by the Softkey Interface. 
Be aware that what you see in"modify configuration" will NOT reflect 
the HP 64700 pod's configuration if you change the pod's 
configuration with this command. Also, commands which affect the 
communications channel should NOT be used at all. Other commands 
may confuse the protocol depending upon how they are used. The 
following commands are not recommended for use with 
"pod_command": 

stty, po, xp - Do not use, will change channel operation and hang, 
echo, mac -Usage may confuse the protocol in use on the channel, 
wait -Do not use, will tie up the pod, blocking access, ink, pv -Will 
reset pod and force end release_system. t - Do not use, will confuse 
trace status polling and unload. 
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You can use a command file to perform many functions for you, 
without having to manually type each function. For example, you 
might want to create a command file that loads configuration, loads 
program into memory and displays memory. 

To create such a command file, type "log" and press TAB key. You 
will see a command line "log_commands" appears in the command 
field. Next, select "to" in the softkey label, and enter the command file 
name "sample.cmd". This set up a file to record all commands you 
execute. The commands will be logged to the file sample.cmd in the 
current directory. You can use this file as a command file to execute 
these commands automatically. 

Suppose that your configuration file and program are named 
"cmd_rds". To load configuration: 

load configuration cmd_rds <RETURN> 

To load the program into memory: 
load cmd_rds <RETURN> 

To display memory 1000 hex through 1020 hex in mnemonic format: 
display memory lOOOh thru 102 Oh mnemonic 



Using a Command 
File 



Now, to disable logging, type "log" and press TAB key, select "off", 
and press Enter. The command file you created looks like this: 

load configuration cmd_rds 
load cmd_rds 

display memory lOOOh thru 1020h mnemonic 

If you would like to modify the command file, you can use any text 
editor on your host computer. 

To execute this command file, type "sample.cmd", and press Enter. 
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Debugging C 
Programs 



Softkey Interface has following functions to debug C programs. 



■ Including C source lines in memory mnemonic display 

■ Including C source lines in trace listing 

■ Stepping C sources 

The following section describes such features. 

Displaying Memory You can display memory in mnemonic format with C source lines. For 
With C Sources example, to display memory in mnemonic format from address main 
with source lines, enter the following commands. 

display memory main mnemonic <RETURN> 
set source on <RETURN> 

You can display source lines highlighted with the following command. 
set source on inverse_video on <RETURN> 

To display only source lines, use the following command. 
set source only <RETURN> 

Specifying Address with Line Numbers 

You can specify addresses with line numbers of C source program. For 
example, to set a breakpoint to line 20 of "main.c" program, enter the 
following command. 

modify software_breakpoints set main.c: line 

2 0 <RETURN> 

You can include C source information in trace listing. You can use the 
same command as the case of memory display. For example, to display 
trace listing with source lines highlighted, enter the following 
command. 

display trace <RETURN> 

set source on inverse_video on <RETURN> 

Stepping C Sources You can direct the emulator to execute a line or a number of lines at a 

time. For example, to step one line from address main, enter the 
following command. 



Displaying Trace with 
C Sources 
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step source from main <RETURN> 

To step 1 line from the current line, enter the following command. 
step source <RETURN> 

You can specify the number of lines to be executed. To step 5 lines 
from the current line, enter the following command. 

step 5 source <RETURN> 



Storing Memory 
Contents to an 
Absolute File 



The "Getting Started" chapter shows you how to load absolute files into 
emulation or target system memory. You can also store emulation or 
target system memory to an absolute file with the following command. 



store memory lOOOh thru 1042h to absfile 
<RETURN> 

The command above causes the contents of memory locations 1000 hex 
through 1042 hex to be stored in the absolute file "absfile.X". Notice 
that the ".X" extension is appended to the specified filename. 



Coordinated For information on coordinated measurements and how to use them, 

MeaSU reme ntS r£ ^ er t0 ^ e "Coordinated Measurements" chapter in the Softkey 

"* Interface Reference manual. 
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Register Classes 
and Names 

Summary H8/3048 register designators. All available register class names and 
register names are listed below. 

<REG_CLASS> 

<REG_NAME> Description 

BASIC (All basic registers) 



PC Program counter 

CCR Condition code register 

ERO Register ERO 

ER1 Register ER1 

ER2 Register ER2 

ER3 Register ER3 

ER4 Register ER4 

ER5 Register ER5 

ER6 Register ER6 

ER7 Register ER7 

SP Stack pointer 

MDCR Mode control register(Read Only) 
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SYS(System control) 



MDCR Mode control register(Read Only) 

SYSCR System control register 

DASTCR D/A standby control register 

DIVCR Clock divider control register 

MSTCR Module standby control register 

CSCR Chip select control register 



Even if PSTOP bit of the MSTCR register is set to 1 , the emulator can 
not stop the 0 clock output. 



INTC (Interrupt controller) 



ISCR IRQ sense control register 

IER IRQ enable register 

ISR IRQ status register 

IPRA Interrupt priority register A 

IPRB Interrupt priority register B 

BUSC (Bus controller) 

ABWCR Byte/Word area control register 

ASTCR 2/3 state area control register 

WCR Wait control register 

WCER Wait controller enable register 

BRCR Bus release control register 

RFSHC (Refresh controller) 

RFSHCR Refresh control register 

RTMSCR Refresh timer control/status register 

RTCNT Refresh timer counter 

RTCOR Refresh time constant register 
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DMACO (DMA controller 0) 



MAROA 


Memory address register OA 


ETCROA 


Transfer count register OA 


IOAR0A 


I/O address register OA 


DTCROA 


Data transfer control register OA 


MAROB 


Memory address register OB 


ETCROB 


Transfer count register OB 


IOAR0B 


I/O address register OB 


DTCROB 


Data transfer control register OB 


DMAC1 (DMA controller 1) 


MARIA 


Memory address register 1 A 


ETCR1A 


Transfer count register 1 A 


IOAR1A 


I/O address register 1A 


DTCR1A 


Data transfer control register 1 A 


MAR IB 


Memory address register IB 


ETCR1B 


Transfer count register IB 


IOAR1B 


I/O address register IB 


DTCR1B 


Data transfer control register IB 
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PORT (I/O port) 



PI DDR Port 1 data direction register(Write Only) 

P2DDR Port 2 data direction register(Write Only) 

P3DDR Port 3 data direction register(Write Only) 

P4DDR Port 4 data direction register(Write Only) 

P5DDR Port 5 data direction register(Write Only) 

P6DDR Port 6 data direction register(Write Only) 

8DDR Port 8 data direction register(Write Only) 

9DDR Port 9 data direction register(Write Only) 

ADDR Port A data direction register(Write Only) 

BDDR Port B data direction register(Write Only) 

P 1 DR Port 1 data register 

P2DR Port 2 data register 

P3DR Port 3 data register 

P4DR Port 4 data register 

P5DR Port 5 data register 

P6DR Port 6 data register 

P7DR Port 7 data register(Read Only) 

P8DR Port 8 data register 

P9DR Port 9 data register 

PADR Port A data register 

PBDR Port B data register 

P2PCR Port 2 input pull up MOS control register 

P4PCR Port 4 input pull up MOS control register 

P5PCR Port 5 input pull up MOS control register 



The emulator can not support input pull up MOS control function of 
the P2PCR, P4PCR and P5PCR. 
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ITUG (16 bit integrated timer pulse unit general) 



TSTR Timer start register 

TSNC Timer synchro register 

TMDR Timer mode register 

TFCR Timer function control register 

TOER Timer output master control register 

TOCR Timer output control register 

ITUO (16 bit integrated timer pulse unit 0) 

TCRO Timer control register 0 

TIOR0 Timer I/O control register 0 

TIERO Timer interrupt enable register 0 

TSRO Timer status register 0 

TCNTO Timer counter 0 

GRAO General register AO 

GRBO General register BO 

ITU1 (16 bit integrated timer pulse unit 1) 

TCR1 Timer control register 1 

TIOR1 Timer I/O control register 1 

TIER1 Timer interrupt enable register 1 

TSR1 Timer status register 1 

TCNT1 Timer counter 1 

GRA1 General register Al 

GRB 1 General register B 1 

ITU2 (16 bit integrated timer pulse unit 2) 

TCR2 Timer control register 2 

TIOR2 Timer I/O control register 2 

TIER2 Timer interrupt enable register 2 

TSR2 Timer status register 2 

TCNT2 Timer counter 2 

GRA2 General register A2 

GRB2 General register B2 
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ITU3 (16 bit integrated timer pulse unit 3) 



TCR3 


Timer control register 3 


TIOR3 


Timer I/O control register 3 


TIER3 


Timer interrupt enable register 3 


TSR3 


Timer status register 3 


TCNT3 


Timer counter 3 


GRA3 


General register A3 


GRB3 


General register B3 


BRA3 


Buffer register A3 


BRB3 


Buffer register B3 



ITU4 (16 bit integrated timer pulse unit 4) 



TCR4 


Timer control register 4 


TIOR4 


Timer I/O control register 4 


TIER4 


Timer interrupt enable register 4 


TSR4 


Timer status register 4 


TCNT4 


Timer counter 4 


GRA4 


General register A4 


GRB4 


General register B4 


BRA4 


Buffer register A4 


BRB4 


Buffer register B4 



TPC (Programable timing pattern controller) 



TPMR TPC output mode register 

TPCR TPC output control register 

NDER Next data enable register 

NDRA Next data register A (address: 0xxffa5h) 

NDRAO Next data register A (address: 0xxffa7h) 

NDRB Next data register B (address: 0xxffa4h) 

NDRB2 Next data register B (address: 0xxffa6h) 



WDT (Watch dog timer) 

WDTCSR Timer control/status register 

WDTCNT Timer counter 

RSTCSR Reset control/status register 
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sciO (Serial communication interface 0) 



SMRO Serial mode register 0 

BRRO Bit rate register 0 

SCRO Serial control register 0 

TDRO Transmit data register 0 

SSRO Serial status register 0 

RDRO Receive data register 0 (Read Only) 

SCMRO Smart card mode register 0 

SCII1 (Serial communication interface 1) 

SMR1 Serial mode register 1 

BRR1 Bit rate register 1 

SCR1 Serial control register 1 

TDR1 Transmit data register 1 

SSR1 Serial status register 1 

RDR1 Receive data register 1 (Read Only) 

SCMR1 



ADC (A/D 


converter 


ADDRA 


A/D data register A (Read Only) 


ADDRB 


A/D data register B (Read Only) 


ADDRC 


A/D data register C (Read Only) 


ADDRD 


A/D data register D (Read Only) 


ADCSR 


A/D control/status register 


ADCR 


A/D control register 


DAC (D/A 


converter) 


DADRO 


D/A data register 0 


DADR1 


D/A data register 1 


DACR 


D/A control register 
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FLASH (flash memory) 



FLMCR Flash memory control register 

EBR1 Erase block appoint register 1 

EBR2 Erase block appoint register 2 

RAMCR RAM control register 



These register cannot control the flash memory. But the emulator can 
display or modify these register except for the RAMCR register. The 
RAMCR register is always FF'H. 



Using the Emulator 5-13 



NOCLASS 



The following register names are not included in any register class. 



RO 


Register RO 


Rl 


Register Rl 


R2 


Register R2 


R3 


Register R3 


R4 


Register R4 


R5 


Register R5 


R6 


Register R6 


R7 


Register R7 


EO 


Register EO 


El 


Register El 


E2 


Register E2 


E3 


Register E3 


E4 


Register E4 


E5 


Register E5 


E6 


Register E6 


E7 


Register E7 


ROH 


Register ROH 


ROL 


Register ROL 


R1H 


Register R1H 


R1L 


Register R1L 


R2H 


Register R2H 


R2L 


Register R2L 


R3H 


Register R3H 


R3L 


Register R3L 


R4H 


Register R4H 


R4L 


Register R4L 


R5H 


Register R5H 


R5L 


Register R5L 


R6H 


Register R6H 


R6L 


Register R6L 


R7H 


Register R7H 


R7L 


Register R7L 
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Using the On-chip Flash Memory 



Introduction The H8/3048 emulator is equipped with functions for the on-chip flash 

memory of H8/3048F microprocessor. So you can direct the on-chip 
flash memory using the H8/3048 emulator. 

The following pages will describe differences between actual on-chip 
flash memory and the H8/3048 emulator. You need to pay attention for 
following contents. 



Memory Mapping The H8/3048 emulator uses emulation memory instead of actual 

on-chip flash memory of the H8/3048F microprocessor. So you need to 
map this area as emulation ROM in the emulator configuraiton before 
using the H8/3048 emulator. And also, you need to configure the 
H8/3048 emulator as H8/3048F and mode 5/6/7 in the emulator 
configuration to use flash memory functions. 



Note Ha When you use the on-chip flash memory on the H8/3048 emulator, you 

must map that area as emulation ROM. When you power on the 
emulator, all memory space except internal RAM is mapped as target 
RAM. Therefore, if you don't map this area properly, you can not use 
the flash memory functions. 
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Flash Memory 
Registers 



You don't need to take care of FLMCR, EBR1, EBR2 and RAMCR 
registers, since the H8/3048 emulator uses emulation memory instead 
of actual on-chip flash memory and does not use these registers. 



Note 
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You cannot direct these registers to control the flash memory functions. 
These register are not effctive for the on-chip flash memory operation 
on the H8/3048 emulator. 



Note 



4 



The H8/3048 emulator can display or modify these registers except for 
the RAMCR register. RAMCR is always FF'H. 



Note 
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You cannot do flash memory emulation by RAM using RAMCR 
register. 



Programming/ 
Erasing Flash 
Memory 



Programming Data To writ e data onto the on-chip flash memory, you need to supply 12V 

to Vpp/RESO pin. When you supply 12V correctly, write to ROM 
break does not occur even if write to ROM break is enabled in the 
emulator configuration. 
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You need only to write data to the destination address only once. The 
H8/3048 emulator can program data correctly and therefore it is not 
necessary to repeat writing unless you prefer. 
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Note .J. If y° u d 011 ' 1 supply 12V to Vpp/RESO pine correctly, the H8/3048 

emulator does not write data to destination address. And if write to 
ROM break is enabled in the emulator configuration, write to ROM 
break will occur when you write date onto on-chip flash memory. 



Erasing Data To eras e data o nto the on-chip flash memory, you need to supply 12V 
to Vpp/RESO pin. 

You cannot use FLMCR, EBR1 and EBR2 registers. These registers 
aren't effective in the emulator operation. As a result, you cannot use 
block-erase to erase your data of the on-chip flash memory. 

Also, you cannot prewrite the data using inverted data. If you write 
inverted data onto on-chip flash memory, the H8/3048 emulator will 
write inverted data onto on-chip flash memory area (i.e data can never 
be 00' H, it can be inverted data). 
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Note I* i s recommended to write 00' h to destination address directly, when 

you want to prewrite the data of the on-chip flash memory. 



Protection Mode The H8/3048 emulator does not support the following protection modes. 

■ Block protection 

■ Emulation protection 

■ Error protection 
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Note Wk The H8/3048 emulator never detects errors such as read cycle to 

on-chip flash memory area, exceptions, and execution of "SLEEP" 
instruction during writing/erasing on-chip flash memory area. 



Boot Mode The H8/3048 emulator drives into the boot mode, when the emulator 

accepts r eset sig nal from target system and you supply 12V to MD2 
and Vpp/RESO pin. Then, emulation status becomes Running user 
program. Emulation reset does not cause the boot mode. 



Note MSa While the boot program on internal PROM is in progress, break 

tm command is suspended and occurs after the boot program is completed. 

If you want to discontinue the boot program, you need to reset the 
emulator. 



Note The H8/3048 emulator does not trace execution of the boot program on 

■ internal PROM. 



Note I While the emulator is executing the boot program on internal PROM, 

NMI must not occur. Because the emulator cannot prohibit the NMI at 
this time. 
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In-circuit emulation 

installing the PGA adaptor, 3-4, 3-7 

PGA adaptor, 3-3 

QFP adaptor, 3-3 

QFP probe, 3-3 

QFP socket/adaptor, 3-3 
installation 

hardware, 2-2 

software, 2-2 
Installing target system probe 

target system probe, 3-2 
interactive measurements, 4-20 
internal clock source, 4-3 
internal DMA cycles, 4-15 
internal RAM 

mapping, 2-8, 4-10 
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internal ROM 

mapping, 2-8, 4-9 

L limitations 

DMA support, 1-7, 4-9 
Hardware standby mode, 1-7, 4-14 
Interrupts in background, 1-7 
Sleep/standby mode, 1-7 
Watch dog timer in background, 1-7 

linking the getting started sample program, 2-6 

loading absolute files, 2-11 

loading emulator configurations, 4-21 

local symbols, 2-19 
displaying, 2-12 

locked 

end command option, 2-30 
logging of commands, 5-3 
low voltage adaptor 

installation, 3-7 

specification, 3-7 

M mapping memory, 4-9 

mapping of internal RAM, 2-8, 4-10 
mapping of internal ROM, 2-8, 4-9 
measurement system, 2-31 
memory 

characterization, 4-9 

copying, 5-2 

mapping, 4-9 

mnemonic display, 2-13 

mnemonic display with C sources, 5-4 

modifying, 2-16 

repetitively display, 2-15 

searching for strings or expressions, 5-2 
memory characterization, 4-9 
memory mapping 

function codes, 4-9 

on-chip flash memory, 6-1 

ranges, maximum, 4-9 

sequence of map/load commands, 4-11 
mnemonic memory display, 2-13 
modify command 
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configuration, 4-1 
memory, 2-16 

software breakpoints clear, 2-20 

software breakpoints set, 2-19 
module, 2-31 
monitor 

breaking into, 2-17 

N non-maskable interrupt, 4-13 
nosymbols, 2-11 
notes 

"debug" option must need to generate local symbol information, 2-6 

/STBY input will give the emulator /RES input, 4-14 

Break during DMA transfer, 2-17 

default mapping of memory, 4-9 

DMA to emulation memory not supported, 4-12 

External DMA accesses to emulation memory, 4-9 

map memory before loading programs, 4-11 

mapping of internal RAM, 4-10 

mapping of internal ROM, 4-9 

pod commands that should not be executed, 5-2 

refresh and internal DMA cycle in background, 4-15 

selecting internal clock forces reset, 4-4 

software breakpoints not allowed in target ROM, 2-17 

software breakpoints only at opcode addresses, 2-17 

Trace internal DMAC cycles, 4-19 

Trace refresh cycles, 4-19 

use the "set" command at each window, 2-14 

write to ROM analyzer status, 4-18 

write to ROM in DMA cycles, 4-18 

O On-chip Flash Memory, 1-7 
boot mode, 6-4 
flash memory registers, 6-2 
memory mapping, 6-1 
protect mode, 6-3 
on-line help, 2-9 

P PATH, HP-UX environment variable, 2-7 
PGA adaptor, 3-3 

installation procedure, 3-4, 3-7 
PGA pin assignment, 3-12 
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pmon 

User Interface Software, 2-30 
pod_command, 2-10 

features available with, 5-2 

help information, 2-10 
predefining stack pointer, 4-16 
prerequisites for using the emulator, 2-2 
processor operation mode, 4-7 
programming flash memory, 6-2 
protection mode, 6-3 
Purpose of the Emulator, 1-1 

Q QFP adaptor, 3-3 
QFP probe, 3-3 
QFP socket/adaptor, 3-3 

R RAM 

mapping emulation or target, 4-10 
real-time execution 

restricting the emulator to, 4-5 
refresh cycle, 4-15 
REGISTER CLASS, 5-6 
register display/modify, 2-21 
REGISTER NAME , 5-6 
registers 

classes, 2-21 
release_system 

end command option, 2-30, 4-20 - 4-21 
repetitive display of memory, 2-15 
reset (emulator) 

running from target reset, 2-15, 3-11 
restrict to real-time runs 

emulator configuration, 4-5 

permissible commands, 4-5 

target system dependency, 4-6 
ROM 

mapping emulation or target, 4-10 

writes to, 4-10 
run command, 2-15 
run from target reset, 3-11 
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S sample program 

description, 2-2 
sample program, linking, 2-6 
saving the emulator configuration, 4-20 
simulated I/O, 4-19 
softkey driven help information, 2-9 
Softkey Interface 

entering, 2-7 

exiting, 2-30 

on-line help, 2-9 
software breakpoints, 2-17 

clearing, 2-20 

enabling/disabling, 2-18 

setting, 2-19 
software installation, 2-2 
special code 

software breakpoints, 2-17 
stack pointer,defining, 4-16 
status qualifiers, 2-25 
step command, 2-20 

with C program, 5-4 
string delimiters, 2-10 
symbols 

displaying, 2-11 

in memory display, 2-14 
system overview, 2-2 

T target memory access, 4-15 

target memory, loading absolute files, 2-11 
target reset 

running from, 3-11 
target system 

dependency on executing code, 4-6 

PGA adaptor, 3-3 

QFP adaptor, 3-3 
Target system probe 

installation, 3-2 
Terminal Interface, 2-10 
trace 

display with C source lines, 5-4 
displaying the, 2-23 

displaying with time count absolute, 2-24 
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internal DMAC, 4-18 
specifying trigger condition, 2-26 
trace about, 2-27 

tracing background operation, 4-18 
tracing refresh cycles, 4-19 
transfer address, running from, 2-15 
trigger 

specifying, 2-22 
trigger condition, 2-26 
trigger state, 2-23 

U undefined software breakpoint, 2-18 

user (target) memory, loading absolute files, 2-11 

V visible background cycles, 4-15 

W window systems, 2-30 

write to ROM break, 4-17 
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